← Home

@aws-amplify/storage

npm Repository Homepage

Storage category of aws-amplify

98
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

amzn-ossaws-amplify-opsamplify-studio-uibuilderamplify-codegenamplify-data-dev-npmaws-amplify-data-runtime

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
publish-pattern suspicious-version-number AI (publish-pattern): Version 6.6.6 is a legitimate sequential release in a 2261-version package from the official AWS Amplify publisher. Repeating-digit heuristic is a stable false positive for this package. ai
publish-pattern new-deps-added AI (publish-pattern): All 5 new deps (tslib, buffer, @aws-sdk/types, @smithy/md5-js, fast-xml-parser) are well-known, legitimate packages consistent with AWS S3 storage functionality. No suspicious additions. ai
source-diff source-size-dropped AI (source-diff): Source size drop is consistent with modular refactoring (more files, less total code). No stub/redirect indicators present. ai
source-diff large-new-source-files AI (source-diff): AWS Amplify v6 modular refactor splits code into many smaller files; large file count increases are expected and consistent with the simultaneous source size reduction. ai
dependencies unvetted-dep:@aws-sdk/client-s3-browser AI (dependencies): Early AWS SDK v3 preview dependency used by the official AWS Amplify storage package; same AWS ecosystem, no security concern. ai
maintainer-change maintainer-removed AI (maintainer-change): Removal of richardzcode is consistent with normal AWS team transitions. ai
provenance publisher-changed AI (provenance): Both powerful23 and mlabieniec are known AWS Amplify team members; publisher rotation is normal for this org's packages. ai
maintainer-change maintainer-added AI (maintainer-change): amzn-oss, jamesiri, jpeddicord are AWS team accounts; routine team roster changes for an official AWS package. ai
provenance no-provenance AI (provenance): aws-amplify-ops consistently publishes without Sigstore provenance; this is expected for this publisher and package family. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decoding of FileReader.readAsDataURL result is standard React Native file handling; no obfuscation or malicious payload present. ai
bogus-package bogus-package AI (bogus-package): This is a mature AWS Amplify subpath package entry point; minimal README/keywords and version number are expected for this package structure, not spam indicators. ai

Versions (showing 98 of 398)

Hide prereleases
Version Deps Published
1.3.3 1 / 1
1.3.0 5 / 0
1.2.4 1 / 1
1.2.3 1 / 1
1.2.2 1 / 19
1.1.2 1 / 19
1.1.0 1 / 19
1.0.36 1 / 19
1.0.35 1 / 19
1.0.34 1 / 19
1.0.33 1 / 19
1.0.31 1 / 21
1.0.30 1 / 21
1.0.29 1 / 21
1.0.28 1 / 21
1.0.27 1 / 21
1.0.26 1 / 21
1.0.25 1 / 21
1.0.24 1 / 21
1.0.23 1 / 21
1.0.22 1 / 21
1.0.21 1 / 21
1.0.20 1 / 21
1.0.19 1 / 21
1.0.18 1 / 21
1.0.17 1 / 21
1.0.16 1 / 21
1.0.15 2 / 21
1.0.14 2 / 21
1.0.13 2 / 21
1.0.12 2 / 21
1.0.11 2 / 21
1.0.10 2 / 21
1.0.9 2 / 21
1.0.8 2 / 21
1.0.7 2 / 21
1.0.6 2 / 21
1.0.5 2 / 21
1.0.4 2 / 21
1.0.3 2 / 21
1.0.2 2 / 21
1.0.1 2 / 21
1.0.0 2 / 21
6.14.1-unstable-e9276c4-20260414114832 6 / 3
6.14.1-unstable-93487ff-20260421144305 6 / 3
6.14.1-unstable-59fbe11-20260414103406 6 / 3
6.14.0-unstable-a7014f9-20260413083601 6 / 3
6.14.0-unstable-8968564-20260409145519 6 / 3
6.13.3-unstable-e80e1f0-20260316103432 6 / 3
6.13.3-unstable-c9706b8-20260311135306 6 / 3
6.13.3-unstable-be61b90-20260311152642 6 / 3
6.13.3-unstable-b4c0f94-20260320110954 6 / 3
6.13.3-unstable-a369be6-20260320051840 6 / 3
6.13.3-unstable-7b6244c-20260318100946 6 / 3
6.13.3-unstable-7560ef8-20260318093619 6 / 3
6.13.2-unstable.3246992.0 6 / 3
6.13.2-unstable.168d5da.0 6 / 3
6.13.2-unstable.0c8161a.0 6 / 3
6.13.2-unstable-f4e2b9f-20260301145033 6 / 3
6.13.2-unstable-ef76864-20260213100230 6 / 3
6.13.2-unstable-eb205a6-20260305162802 6 / 3
6.13.2-unstable-d2ae770-20260218155038 6 / 3
6.13.2-unstable-b95c351-20260301141744 6 / 3
6.13.2-unstable-af6ff6d-20260303105758 6 / 3
6.13.2-unstable-a279b90-20260217094950 6 / 3
6.13.2-unstable-9108e72-20260310171257 6 / 3
6.13.2-unstable-689fd88-20260213110139 6 / 3
6.13.2-unstable-54bf753-20260302120734 6 / 3
6.13.2-unstable-4971ebd-20260304125212 6 / 3
6.13.2-unstable-24c0a0b-20260306161434 6 / 3
6.13.1-unstable.7976008.0 6 / 3
6.13.1-unstable.2e1c146.0 6 / 3
6.12.1-unstable.c10343a.0 6 / 3
6.12.1-unstable.61cc23b.0 6 / 3
6.12.1-mypreid.0aaa467.0 6 / 3
6.12.1-mypreid-cffd682-20260202112358 6 / 3
6.12.1-mypreid-c2c4292-20260202114045 6 / 3
6.12.1-coolfeature-28752fd-20260202121056 6 / 3
6.11.2-unstable.b6d4c7a.0 6 / 3
6.11.2-unstable.a361dd1.0 6 / 3
6.11.2-unstable.5a0e006.0 6 / 3
6.11.1-unstable.fb2c88e.0 6 / 3
6.11.1-unstable.f31b957.0 6 / 3
6.11.1-unstable.aac3c03.0 6 / 3
6.11.1-unstable.a9e970f.0 6 / 3
6.11.1-unstable.a93c38c.0 6 / 3
6.11.1-context-cogs.077566e.0 6 / 3
6.10.2-unstable.f59a4f7.0 6 / 3
6.10.2-unstable.a71ee35.0 6 / 3
6.10.2-unstable.94352c7.0 6 / 3
6.10.2-unstable.91c2933.0 6 / 3
6.10.2-unstable.8c43daf.0 6 / 3
6.10.2-unstable.29080f6.0 6 / 3
6.10.2-unstable.1fe3c5d.0 6 / 3
6.10.1-unstable.c6c6079.0 6 / 3
6.10.1-unstable.5bf5685.0 6 / 3
0.0.0-unstable-1ca644b-20260128091132 6 / 3
0.0.0-changesets-preid-f620002-20260129130740 6 / 3

v1.3.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.3.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.4

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.3

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.2.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.2

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.1.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.36

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.35

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.0.34

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.33

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.31

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.30

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.29

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.28

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.27

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.26

2 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Publisher changed: mlabieniec → aws-amplify-ops (on 2019-03-04) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2019-03-04. This could indicate a legitimate maintainer transition or an account compromise.

v1.0.25

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.24

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.23

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.22

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.21

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.20

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.19

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.18

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-11-01) provenance

This version was published by a different npm account than previous versions on 2018-11-01. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.17

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-10-29) provenance

This version was published by a different npm account than previous versions on 2018-10-29. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.16

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-10-17) provenance

This version was published by a different npm account than previous versions on 2018-10-17. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.15

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-10-04) provenance

This version was published by a different npm account than previous versions on 2018-10-04. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.14

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-10-02) provenance

This version was published by a different npm account than previous versions on 2018-10-02. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.13

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-09-27) provenance

This version was published by a different npm account than previous versions on 2018-09-27. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.12

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-09-21) provenance

This version was published by a different npm account than previous versions on 2018-09-21. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.11

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-09-21) provenance

This version was published by a different npm account than previous versions on 2018-09-21. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.10

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-09-17) provenance

This version was published by a different npm account than previous versions on 2018-09-17. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.9

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-09-12) provenance

This version was published by a different npm account than previous versions on 2018-09-12. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.8

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-09-09) provenance

This version was published by a different npm account than previous versions on 2018-09-09. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.7

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-08-28) provenance

This version was published by a different npm account than previous versions on 2018-08-28. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.6

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-08-28) provenance

This version was published by a different npm account than previous versions on 2018-08-28. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.5

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-08-14) provenance

This version was published by a different npm account than previous versions on 2018-08-14. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.4

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-08-06) provenance

This version was published by a different npm account than previous versions on 2018-08-06. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.3

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-07-28) provenance

This version was published by a different npm account than previous versions on 2018-07-28. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.2

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-07-19) provenance

This version was published by a different npm account than previous versions on 2018-07-19. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.1

2 findings
HIGH Publisher changed: powerful23 → mlabieniec (on 2018-07-18) provenance

This version was published by a different npm account than previous versions on 2018-07-18. This could indicate a legitimate maintainer transition or an account compromise.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v6.13.2-unstable-f4e2b9f-20260301145033

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.13.2-unstable-af6ff6d-20260303105758

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v6.13.1-unstable.2e1c146.0

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.