@aws-sdk/config-resolver
[](https://www.npmjs.com/package/@aws-sdk/config-resolver) [](https://www.npmjs.com/package/@aws-sd
19
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
mattsb42-awskuheamzn-ossaws-sdk-bottrivikr-aws
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@aws-sdk/util-middleware | AI (dependencies): First-party AWS SDK package published by aws-sdk-bot; unvetted status reflects pipeline ordering, not a real risk. | ai | |
| dependencies | unvetted-dep:@aws-sdk/util-config-provider | AI (dependencies): First-party AWS SDK package published by aws-sdk-bot; unvetted status reflects pipeline ordering, not a real risk. | ai | |
| source-diff | large-new-source-files | AI (source-diff): AWS SDK v3 packages routinely add large numbers of source files during modularization refactors; this is expected behavior for coordinated SDK version releases. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @aws-sdk/util-middleware is a first-party AWS SDK package in the same monorepo, published by the same aws-sdk-bot. Adding internal SDK utilities is expected and low-risk. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): AWS SDK team rotations are routine; aws-sdk-bot remains the publisher and both maintainers are known AWS contributors. Not indicative of a takeover. | ai | |
| source-diff | obfuscated-file:dist/cjs/CustomEndpointsConfig.js | AI (source-diff): The long line is a base64-encoded inline source map, standard for TypeScript-compiled CJS output. The code itself is fully readable. This is a stable false positive for AWS SDK compiled packages. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): AWS SDK team additions are expected for the official aws-sdk-js-v3 project published by aws-sdk-bot. No compromise indicators. | ai | |
| phantom-deps | phantom-dep:@aws-sdk/signature-v4 | AI (phantom-deps): AWS SDK v3 monorepo packages commonly declare sibling deps for type usage without direct imports; stable false positive for this package. | ai | |
| provenance | no-provenance | AI (provenance): Package predates widespread Sigstore provenance adoption on npm; published by trusted aws-sdk-bot with strong track record. | ai |