cdktn-cli
CDK Terrain CLI
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Org-level rename (cdktn-team) with strong track record; provenance unchanged. | ai | |
| source-diff | obfuscated-file:bundle/bin/cmds/handlers.js | AI (source-diff): esbuild bundle output, not obfuscated; color table and standard library patterns visible in sample. | ai | |
| source-diff | net-exec-file:bundle/bin/cmds/handlers.js | AI (source-diff): Network and exec capabilities are expected in a CDK CLI tool; no hostile destination evident in samples. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): CLI tool legitimately uses child_process; no hostile invocation pattern in samples. | ai | |
| semgrep | semgrep:child-process-spawn | AI (semgrep): Spawn usage consistent with CLI orchestration; no injected command strings visible. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Telemetry/checkpoint env check is documented cdktn behavior, not credential exfiltration. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Sentry integration reads env for config; standard pattern for this devtool. | ai | |
| source-diff | obfuscated-file:bundle/bin/cdktn.js | AI (source-diff): esbuild bundle output, not obfuscated; standard minification pattern confirmed by sample content. | ai | |
| phantom-deps | phantom-dep:punycode | AI (phantom-deps): Bundled dep; phantom-dep heuristic fires on bundled packages by design. | ai | |
| phantom-deps | phantom-dep:@types/node | AI (phantom-deps): Type-only dep; not directly imported at runtime. | ai | |
| phantom-deps | phantom-dep:@cdktn/hcl2cdk | AI (phantom-deps): Bundled into output; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@cdktn/hcl2json | AI (phantom-deps): Bundled into output; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:@cdktn/hcl-tools | AI (phantom-deps): Bundled into output; phantom-dep false positive. | ai | |
| phantom-deps | phantom-dep:yoga-layout-prebuilt | AI (phantom-deps): Platform binary dep; phantom-dep heuristic not applicable. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require inside bundled CLI plugin/layout system; stable false positive for this package. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 0.23.4 | 8 / 33 | |
| 0.23.3 | 7 / 35 | |
| 0.23.0 | 30 / 53 | |
| 0.22.0 | 27 / 62 | |
| 0.21.0 | 27 / 62 | |
| 0.0.1 | 0 / 0 |
v0.23.4
7 findingsThis version was published by a different npm account than previous versions on 2026-07-03. This could indicate a legitimate maintainer transition or an account compromise.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.
Spreading entire process.env into an object — may capture all secrets 71 | To create a new signature, you can simply delete this file at any time. 72 | See https://cdktn.io/docs/telemetry for more > 73 | information on how to disable it.`)}et.getUserId=rJ;async function iJ(e){if(process.env.CHECKPOINT_DISABLE)return;e.runI 74 | If your project has the associated pre-built provider already installed, CDKTN updates the pre-built provider. Other 75 | /*! Bundled license information:
Spreading entire process.env into an object — may capture all secrets 71 | To create a new signature, you can simply delete this file at any time. 72 | See https://cdktn.io/docs/telemetry for more > 73 | information on how to disable it.`)}et.getUserId=rJ;async function iJ(e){if(process.env.CHECKPOINT_DISABLE)return;e.runI 74 | If your project has the associated pre-built provider already installed, CDKTN updates the pre-built provider. Other 75 | /*! Bundled license information:
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.22.0
2 findingsThis version was published by a different npm account than previous versions on 2026-02-17. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.21.0
2 findingsThis version was published by a different npm account than previous versions on 2026-02-15. This could indicate a legitimate maintainer transition or an account compromise.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.