← Home

cdk-assets

npm Repository Homepage

CDK Asset Publishing Tool

100
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

aws-cdk-team

Keywords

awscdk

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:lib/aws-types.js AI (source-diff): File contains generated AWS SDK type definitions (enums, constants) compiled from TypeScript. Long lines from object literals, not obfuscation. ai
semgrep semgrep:env-spread AI (semgrep): CDK asset tool passes env vars to Docker child processes; standard pattern for AWS tooling. ai
semgrep semgrep:base64-decode AI (semgrep): Decoding ECR authorization tokens from base64 is the documented AWS ECR auth flow. ai
semgrep semgrep:child-process-import AI (semgrep): Core functionality requires spawning Docker/CLI processes to publish CDK assets. ai
semgrep semgrep:child-process-spawn AI (semgrep): Core functionality requires spawning Docker/CLI processes to publish CDK assets. ai

Versions (showing 100 of 616)

Version Deps Published
2.151.8 7 / 26
2.151.7 7 / 26
2.151.6 7 / 26
2.151.5 7 / 26
2.151.4 7 / 26
2.151.3 7 / 26
2.151.2 7 / 26
2.151.1 7 / 11
2.151.0 7 / 11
2.150.0 7 / 11
2.149.0 7 / 11
2.148.1 7 / 11
2.148.0 7 / 11
2.147.3 7 / 11
2.147.2 7 / 11
2.147.1 7 / 11
2.147.0 7 / 11
2.146.0 7 / 11
2.145.0 7 / 11
2.144.0 7 / 11
2.143.1 7 / 11
2.143.0 7 / 11
2.142.1 7 / 11
2.142.0 7 / 11
2.141.0 7 / 11
2.140.0 7 / 11
2.139.1 7 / 11
2.139.0 7 / 11
2.138.0 7 / 11
2.137.0 7 / 11
2.136.1 7 / 11
2.136.0 7 / 11
2.135.0 7 / 11
2.134.0 7 / 11
2.133.0 7 / 11
2.132.1 7 / 11
2.132.0 7 / 11
2.131.0 7 / 11
2.130.0 7 / 11
2.129.0 7 / 11
2.128.0 7 / 11
2.127.0 7 / 11
2.126.0 7 / 11
2.125.0 7 / 11
2.124.0 7 / 11
2.123.0 7 / 11
2.122.0 7 / 11
2.121.1 7 / 11
2.121.0 7 / 11
2.120.0 7 / 11
2.119.0 7 / 11
2.118.0 7 / 11
2.117.0 7 / 11
2.116.1 7 / 11
2.116.0 7 / 11
2.115.0 7 / 11
2.114.1 7 / 11
2.114.0 7 / 11
2.113.0 7 / 11
2.112.0 7 / 11
2.111.0 7 / 11
2.110.1 7 / 11
2.110.0 7 / 11
2.109.0 7 / 11
2.108.1 7 / 11
2.108.0 7 / 11
2.107.0 7 / 11
2.106.1 7 / 11
2.106.0 7 / 11
2.105.0 7 / 11
2.104.0 7 / 11
2.103.1 7 / 11
2.103.0 7 / 11
2.102.1 7 / 11
2.102.0 7 / 11
2.101.1 7 / 11
2.101.0 7 / 11
2.100.0 7 / 11
2.99.1 7 / 11
2.99.0 7 / 11
2.98.0 7 / 11
2.97.1 7 / 11
2.97.0 7 / 11
2.96.2 7 / 11
2.96.1 7 / 11
2.96.0 7 / 11
2.95.1 7 / 11
2.95.0 7 / 11
2.94.0 7 / 11
2.93.0 7 / 11
2.92.0 7 / 11
2.91.0 7 / 11
2.90.0 7 / 11
2.89.0 7 / 11
2.88.0 7 / 11
2.87.0 7 / 11
2.86.0 7 / 11
2.85.0 7 / 11
2.84.0 7 / 11
2.83.1 7 / 11
Showing 100 of 616 Next page →

v2.151.8

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.151.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.151.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.151.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.151.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.151.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.151.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v2.151.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.151.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.150.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.149.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.148.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.148.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.147.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.147.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.147.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.147.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.146.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.145.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.144.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.143.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.143.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.142.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.142.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.141.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.140.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.139.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v2.139.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.