projen
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| vendored-integrity | unresolved-vendored-tree:node_modules/@iarna/toml | AI (vendored-integrity): Declared bundledDependency; version-hash mismatch not implant evidence. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/undici-types | AI (vendored-integrity): Common @types/node transitive artifact, unchanged from prior approved version. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/just-diff-apply | AI (vendored-integrity): Transitive dep, unchanged from prior approved version. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/has-own-prop | AI (vendored-integrity): Transitive dep of bundled tooling; no diff vs prior approved version. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/yargs | AI (vendored-integrity): Bundled dependency declared in package.json; version mismatch only. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/xregexp | AI (vendored-integrity): Common transitive dep, unindexed version mismatch. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/which-module | AI (vendored-integrity): Common transitive dep, unindexed version mismatch. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/core-js-pure | AI (vendored-integrity): Transitive dep pulled via bundled deps; unindexed version, not an implant. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/ansi-regex | AI (vendored-integrity): Common transitive dep, unindexed version mismatch. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/@babel/runtime-corejs3 | AI (vendored-integrity): Transitive dep pulled via bundled deps; unindexed version, not an implant. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/yargs/node_modules/decamelize | AI (vendored-integrity): Nested transitive dep, unindexed version. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/y18n | AI (vendored-integrity): Common transitive dep, unindexed version mismatch. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/yargs-parser | AI (vendored-integrity): Nested transitive dep, unindexed version. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/@babel/runtime | AI (vendored-integrity): Common transitive toolchain dep; byte mismatch likely unindexed version, not implant. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/yaml | AI (vendored-integrity): yaml is a declared bundledDependency; expected vendoring, not a hidden payload. | ai | |
| source-diff | obfuscated-file:lib/util/task-env.js | AI (source-diff): Readable commented helper module; long-line heuristic false positive. | ai | |
| source-diff | obfuscated-file:lib/release/apply-version-bump.task.js | AI (source-diff): Readable commented CJS build output of release bump task; long-line heuristic false positive. | ai | |
| source-diff | obfuscated-file:lib/javascript/pnpm-workspace-config.js | AI (source-diff): jsii/json2jsii-generated schema serializer; long lines are codegen, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/util/exec.js | AI (source-diff): TSC-compiled ESM helpers, not obfuscation; stable build output. | ai | |
| source-diff | obfuscated-file:lib/task-shell.js | AI (source-diff): Compiled jsii class, legible source. | ai | |
| source-diff | obfuscated-file:lib/typescript/typescript-runner.js | AI (source-diff): Compiled jsii class, legible source. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get in documented proxy-binding helper. | ai | |
| source-diff | obfuscated-file:lib/cli/cmds/synth.js | AI (source-diff): Standard tsc CJS output. | ai | |
| source-diff | encoded-string-file:lib/run-task.cjs | AI (source-diff): Bundled task runner (esbuild); long strings are build artifacts. | ai | |
| source-diff | obfuscated-file:lib/cli/cmds/run-task.js | AI (source-diff): TS-compiler emitted CJS; long lines are helper preamble, not obfuscation. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): getRealEnvVars in task runner; expected for a CLI. | ai | |
| source-diff | obfuscated-file:lib/task-runner.js | AI (source-diff): projen's own compiled task runner, tsc output not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/cli/task-runtime.js | AI (source-diff): Compiled task runtime, tsc output. | ai | |
| source-diff | net-exec-file:node_modules/dax/script/mod.js | AI (source-diff): dax is a shell-execution library; network+exec patterns are its core functionality. | ai | |
| source-diff | obfuscated-file:node_modules/dax/esm/mod.js | AI (source-diff): Bundled transpiled output from dax (Deno-to-Node build); not obfuscated. | ai | |
| source-diff | obfuscated-file:node_modules/dax/script/mod.js | AI (source-diff): Bundled transpiled output from dax (Deno-to-Node build); not obfuscated. | ai | |
| source-diff | net-exec-file:node_modules/dax/esm/mod.js | AI (source-diff): dax is a shell-execution library; network+exec patterns are its core functionality. | ai | |
| source-diff | obfuscated-file:lib/cdk/jsii-build.js | AI (source-diff): jsii-compiled TS output with long lines; readable code, not obfuscation. Stable for this package. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher changed to GitHub Actions with SLSA provenance; legitimate CI/CD transition. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): cdklabs-automation replaced by equivalent AWS automation accounts. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are known AWS/projen contributors. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): Legitimate AWS org transition: cdklabs-automation → mrgrain/amzn-oss/projen-automation. | ai | |
| source-diff | obfuscated-file:lib/python/pyproject-toml.js | AI (source-diff): jsii-compiled TypeScript; generated config types. | ai | |
| source-diff | obfuscated-file:lib/awscdk/private/feature-flags-v2.const.js | AI (source-diff): Generated CDK feature flags constant; long lines from large object literal. | ai | |
| source-diff | obfuscated-file:lib/util/diff.js | AI (source-diff): jsii-compiled TypeScript; readable diff utility. | ai | |
| source-diff | obfuscated-file:lib/github/dependency-review.js | AI (source-diff): jsii-compiled TypeScript; readable GitHub workflow component. | ai | |
| source-diff | obfuscated-file:lib/release/commit-tag-version.js | AI (source-diff): jsii-compiled TypeScript; readable release tooling. | ai | |
| source-diff | obfuscated-file:lib/release/bump-type.js | AI (source-diff): jsii-compiled TypeScript; readable semver utility functions. | ai | |
| source-diff | obfuscated-file:lib/javascript/biome/biome.js | AI (source-diff): jsii-compiled TypeScript class; readable source. | ai | |
| source-diff | obfuscated-file:lib/ai-instructions.js | AI (source-diff): jsii-compiled TypeScript, not obfuscated; readable source with JSDoc comments. | ai | |
| source-diff | obfuscated-file:lib/javascript/biome/biome-config.js | AI (source-diff): Generated config type definitions (toJson_ exports); long lines from many exports, not obfuscation. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Task runner intentionally merges process.env with task-specific env vars; core design of projen. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Plugin/module loader pattern; projen dynamically loads project modules by design. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): CLI synth tool legitimately spawns child processes; expected for a project scaffolding tool. | ai | |
| phantom-deps | phantom-dep:shx | AI (phantom-deps): shx is listed in both dependencies and bundledDependencies; phantom-dep is a false positive here. | ai |
Versions (showing 51 of 222)
| Version | Deps | Published |
|---|---|---|
| 0.101.19 | 15 / 33 | |
| 0.101.18 | 15 / 33 | |
| 0.101.17 | 15 / 33 | |
| 0.101.16 | 15 / 33 | |
| 0.101.15 | 15 / 33 | |
| 0.101.14 | 15 / 33 | |
| 0.101.13 | 15 / 33 | |
| 0.101.12 | 15 / 33 | |
| 0.101.11 | 15 / 33 | |
| 0.101.10 | 15 / 33 | |
| 0.101.9 | 15 / 33 | |
| 0.101.8 | 15 / 33 | |
| 0.101.7 | 15 / 33 | |
| 0.101.6 | 15 / 33 | |
| 0.101.5 | 15 / 33 | |
| 0.101.4 | 15 / 33 | |
| 0.101.3 | 15 / 33 | |
| 0.101.2 | 15 / 33 | |
| 0.101.1 | 15 / 33 | |
| 0.101.0 | 15 / 33 | |
| 0.100.7 | 15 / 33 | |
| 0.100.6 | 15 / 33 | |
| 0.100.5 | 15 / 33 | |
| 0.100.4 | 15 / 33 | |
| 0.100.3 | 15 / 33 | |
| 0.100.2 | 15 / 33 | |
| 0.100.1 | 15 / 33 | |
| 0.100.0 | 15 / 33 | |
| 0.99.80 | 15 / 33 | |
| 0.99.79 | 15 / 33 | |
| 0.99.78 | 15 / 33 | |
| 0.99.77 | 15 / 33 | |
| 0.99.76 | 15 / 33 | |
| 0.99.75 | 15 / 33 | |
| 0.99.74 | 15 / 33 | |
| 0.99.73 | 15 / 33 | |
| 0.99.72 | 15 / 33 | |
| 0.99.71 | 15 / 33 | |
| 0.99.70 | 15 / 33 | |
| 0.99.69 | 15 / 33 | |
| 0.99.68 | 15 / 33 | |
| 0.99.67 | 15 / 33 | |
| 0.99.66 | 15 / 33 | |
| 0.99.65 | 15 / 33 | |
| 0.99.64 | 15 / 33 | |
| 0.99.63 | 15 / 33 | |
| 0.99.62 | 15 / 33 | |
| 0.99.61 | 15 / 33 | |
| 0.99.60 | 15 / 33 | |
| 0.99.59 | 15 / 33 | |
| 0.99.58 | 15 / 33 |
v0.101.19
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.18
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.17
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.16
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.15
3 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.14
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.13
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.12
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.8
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.7
2 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.4
9 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.3
8 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.2
8 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.1
8 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.101.0
8 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Modified file contains 2 long encoded string(s) (200+ chars). These are commonly used to hide malicious payloads.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.