@aws-sdk/core
Core functions & classes shared by multiple AWS SDK clients.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | large-new-source-files | AI (source-diff): Submodule restructuring adds many files; normal for AWS SDK monorepo packages. | ai | |
| source-diff | obfuscated-file:dist-cjs/submodules/client/index.browser.js | AI (source-diff): CJS bundle output with readable source; standard build artifact for this package. | ai | |
| source-diff | obfuscated-file:dist-es/submodules/client/util-endpoints/lib/aws/partitions.js | AI (source-diff): AWS partitions JSON data exported as a single long line; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist-cjs/submodules/client/index.native.js | AI (source-diff): CJS bundle output with readable source; standard build artifact for this package. | ai | |
| provenance | no-provenance | AI (provenance): AWS SDK packages historically publish without Sigstore provenance; publisher track record (9926 approved) provides sufficient trust signal. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): AWS SDK team rotation is expected for a large monorepo; publisher remains aws-sdk-bot (official AWS automation). No suspicious new maintainers added. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Cosmetic signals (short README, no keywords) are typical of AWS SDK monorepo sub-packages. Package has 41 approved dependents and clear legitimate purpose. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a declared runtime dependency used implicitly via TypeScript compilation output — the standard and documented usage pattern for tslib in TS projects. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in scripts/lint.js loads the package's own package.json via path.join — a benign dev-script pattern, not runtime code. Stable false positive for this package. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @aws-sdk/core is a legitimate AWS SDK scoped package; the Levenshtein match to 'cors' is coincidental and not a typosquat attempt. | ai |
Versions (showing 51 of 201)
| Version | Deps | Published |
|---|---|---|
| 3.974.15 | 8 / 5 | |
| 3.974.14 | 8 / 5 | |
| 3.974.13 | 8 / 5 | |
| 3.974.12 | 8 / 5 | |
| 3.974.11 | 8 / 5 | |
| 3.974.10 | 6 / 5 | |
| 3.974.9 | 6 / 5 | |
| 3.974.8 | 14 / 5 | |
| 3.974.7 | 14 / 5 | |
| 3.974.6 | 14 / 5 | |
| 3.974.5 | 14 / 5 | |
| 3.974.4 | 14 / 5 | |
| 3.974.3 | 14 / 5 | |
| 3.974.2 | 13 / 5 | |
| 3.974.1 | 13 / 5 | |
| 3.974.0 | 13 / 5 | |
| 3.973.27 | 13 / 5 | |
| 3.973.26 | 13 / 5 | |
| 3.973.25 | 13 / 5 | |
| 3.973.24 | 13 / 5 | |
| 3.973.23 | 13 / 5 | |
| 3.973.22 | 13 / 5 | |
| 3.973.21 | 13 / 5 | |
| 3.973.20 | 13 / 5 | |
| 3.973.19 | 13 / 5 | |
| 3.973.18 | 13 / 5 | |
| 3.973.17 | 13 / 5 | |
| 3.973.16 | 13 / 5 | |
| 3.973.15 | 13 / 5 | |
| 3.973.14 | 13 / 5 | |
| 3.973.13 | 13 / 5 | |
| 3.973.12 | 13 / 5 | |
| 3.973.11 | 13 / 5 | |
| 3.973.10 | 13 / 5 | |
| 3.973.9 | 13 / 5 | |
| 3.973.8 | 13 / 5 | |
| 3.973.7 | 13 / 5 | |
| 3.973.6 | 13 / 5 | |
| 3.973.5 | 13 / 5 | |
| 3.973.4 | 13 / 5 | |
| 3.973.3 | 13 / 5 | |
| 3.973.2 | 13 / 5 | |
| 3.973.1 | 13 / 5 | |
| 3.973.0 | 13 / 5 | |
| 3.972.0 | 13 / 5 | |
| 3.970.0 | 13 / 5 | |
| 3.969.0 | 13 / 5 | |
| 3.968.0 | 13 / 5 | |
| 3.967.0 | 13 / 5 | |
| 3.966.0 | 13 / 5 | |
| 3.965.0 | 13 / 5 |
v3.974.15
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.974.14
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.974.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.974.12
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.974.11
4 findingsNewly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.974.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.974.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.974.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.974.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.974.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.974.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.974.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.