projen
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| vendored-integrity | unresolved-vendored-tree:node_modules/@iarna/toml | AI (vendored-integrity): Declared bundledDependency; version-hash mismatch not implant evidence. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/undici-types | AI (vendored-integrity): Common @types/node transitive artifact, unchanged from prior approved version. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/just-diff-apply | AI (vendored-integrity): Transitive dep, unchanged from prior approved version. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/has-own-prop | AI (vendored-integrity): Transitive dep of bundled tooling; no diff vs prior approved version. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/yargs | AI (vendored-integrity): Bundled dependency declared in package.json; version mismatch only. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/xregexp | AI (vendored-integrity): Common transitive dep, unindexed version mismatch. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/which-module | AI (vendored-integrity): Common transitive dep, unindexed version mismatch. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/core-js-pure | AI (vendored-integrity): Transitive dep pulled via bundled deps; unindexed version, not an implant. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/ansi-regex | AI (vendored-integrity): Common transitive dep, unindexed version mismatch. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/@babel/runtime-corejs3 | AI (vendored-integrity): Transitive dep pulled via bundled deps; unindexed version, not an implant. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/yargs/node_modules/decamelize | AI (vendored-integrity): Nested transitive dep, unindexed version. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/y18n | AI (vendored-integrity): Common transitive dep, unindexed version mismatch. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/yargs-parser | AI (vendored-integrity): Nested transitive dep, unindexed version. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/@babel/runtime | AI (vendored-integrity): Common transitive toolchain dep; byte mismatch likely unindexed version, not implant. | ai | |
| vendored-integrity | unresolved-vendored-tree:node_modules/yaml | AI (vendored-integrity): yaml is a declared bundledDependency; expected vendoring, not a hidden payload. | ai | |
| source-diff | obfuscated-file:lib/util/task-env.js | AI (source-diff): Readable commented helper module; long-line heuristic false positive. | ai | |
| source-diff | obfuscated-file:lib/release/apply-version-bump.task.js | AI (source-diff): Readable commented CJS build output of release bump task; long-line heuristic false positive. | ai | |
| source-diff | obfuscated-file:lib/javascript/pnpm-workspace-config.js | AI (source-diff): jsii/json2jsii-generated schema serializer; long lines are codegen, not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/util/exec.js | AI (source-diff): TSC-compiled ESM helpers, not obfuscation; stable build output. | ai | |
| source-diff | obfuscated-file:lib/task-shell.js | AI (source-diff): Compiled jsii class, legible source. | ai | |
| source-diff | obfuscated-file:lib/typescript/typescript-runner.js | AI (source-diff): Compiled jsii class, legible source. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get in documented proxy-binding helper. | ai | |
| source-diff | obfuscated-file:lib/cli/cmds/synth.js | AI (source-diff): Standard tsc CJS output. | ai | |
| source-diff | encoded-string-file:lib/run-task.cjs | AI (source-diff): Bundled task runner (esbuild); long strings are build artifacts. | ai | |
| source-diff | obfuscated-file:lib/cli/cmds/run-task.js | AI (source-diff): TS-compiler emitted CJS; long lines are helper preamble, not obfuscation. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): getRealEnvVars in task runner; expected for a CLI. | ai | |
| source-diff | obfuscated-file:lib/task-runner.js | AI (source-diff): projen's own compiled task runner, tsc output not obfuscation. | ai | |
| source-diff | obfuscated-file:lib/cli/task-runtime.js | AI (source-diff): Compiled task runtime, tsc output. | ai | |
| source-diff | net-exec-file:node_modules/dax/script/mod.js | AI (source-diff): dax is a shell-execution library; network+exec patterns are its core functionality. | ai | |
| source-diff | obfuscated-file:node_modules/dax/esm/mod.js | AI (source-diff): Bundled transpiled output from dax (Deno-to-Node build); not obfuscated. | ai | |
| source-diff | obfuscated-file:node_modules/dax/script/mod.js | AI (source-diff): Bundled transpiled output from dax (Deno-to-Node build); not obfuscated. | ai | |
| source-diff | net-exec-file:node_modules/dax/esm/mod.js | AI (source-diff): dax is a shell-execution library; network+exec patterns are its core functionality. | ai | |
| source-diff | obfuscated-file:lib/cdk/jsii-build.js | AI (source-diff): jsii-compiled TS output with long lines; readable code, not obfuscation. Stable for this package. | ai | |
| provenance | publisher-changed | AI (provenance): Publisher changed to GitHub Actions with SLSA provenance; legitimate CI/CD transition. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): cdklabs-automation replaced by equivalent AWS automation accounts. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are known AWS/projen contributors. | ai | |
| maintainer-change | maintainer-takeover | AI (maintainer-change): Legitimate AWS org transition: cdklabs-automation → mrgrain/amzn-oss/projen-automation. | ai | |
| source-diff | obfuscated-file:lib/python/pyproject-toml.js | AI (source-diff): jsii-compiled TypeScript; generated config types. | ai | |
| source-diff | obfuscated-file:lib/awscdk/private/feature-flags-v2.const.js | AI (source-diff): Generated CDK feature flags constant; long lines from large object literal. | ai | |
| source-diff | obfuscated-file:lib/util/diff.js | AI (source-diff): jsii-compiled TypeScript; readable diff utility. | ai | |
| source-diff | obfuscated-file:lib/github/dependency-review.js | AI (source-diff): jsii-compiled TypeScript; readable GitHub workflow component. | ai | |
| source-diff | obfuscated-file:lib/release/commit-tag-version.js | AI (source-diff): jsii-compiled TypeScript; readable release tooling. | ai | |
| source-diff | obfuscated-file:lib/release/bump-type.js | AI (source-diff): jsii-compiled TypeScript; readable semver utility functions. | ai | |
| source-diff | obfuscated-file:lib/javascript/biome/biome.js | AI (source-diff): jsii-compiled TypeScript class; readable source. | ai | |
| source-diff | obfuscated-file:lib/ai-instructions.js | AI (source-diff): jsii-compiled TypeScript, not obfuscated; readable source with JSDoc comments. | ai | |
| source-diff | obfuscated-file:lib/javascript/biome/biome-config.js | AI (source-diff): Generated config type definitions (toJson_ exports); long lines from many exports, not obfuscation. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Task runner intentionally merges process.env with task-specific env vars; core design of projen. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Plugin/module loader pattern; projen dynamically loads project modules by design. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): CLI synth tool legitimately spawns child processes; expected for a project scaffolding tool. | ai | |
| phantom-deps | phantom-dep:shx | AI (phantom-deps): shx is listed in both dependencies and bundledDependencies; phantom-dep is a false positive here. | ai |
Versions (showing 22 of 222)
| Version | Deps | Published |
|---|---|---|
| 0.1.23 | 2 / 18 | |
| 0.1.22 | 2 / 18 | |
| 0.1.21 | 2 / 18 | |
| 0.1.20 | 2 / 18 | |
| 0.1.19 | 2 / 17 | |
| 0.1.18 | 2 / 17 | |
| 0.1.17 | 2 / 17 | |
| 0.1.16 | 2 / 17 | |
| 0.1.15 | 2 / 17 | |
| 0.1.14 | 2 / 17 | |
| 0.1.13 | 2 / 17 | |
| 0.1.12 | 2 / 15 | |
| 0.1.11 | 2 / 14 | |
| 0.1.10 | 2 / 14 | |
| 0.1.7 | 1 / 13 | |
| 0.1.6 | 1 / 13 | |
| 0.1.5 | 1 / 13 | |
| 0.1.4 | 1 / 13 | |
| 0.1.3 | 1 / 13 | |
| 0.1.2 | 1 / 13 | |
| 0.1.1 | 1 / 13 | |
| 0.1.0 | 1 / 13 |
v0.1.23
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.22
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.21
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.20
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.19
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.18
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.17
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.15
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.14
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.13
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.12
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.