@aws-sdk/core
Core functions & classes shared by multiple AWS SDK clients.
1
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
amzn-ossaws-sdk-bot
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | large-new-source-files | AI (source-diff): Submodule restructuring adds many files; normal for AWS SDK monorepo packages. | ai | |
| source-diff | obfuscated-file:dist-cjs/submodules/client/index.browser.js | AI (source-diff): CJS bundle output with readable source; standard build artifact for this package. | ai | |
| source-diff | obfuscated-file:dist-es/submodules/client/util-endpoints/lib/aws/partitions.js | AI (source-diff): AWS partitions JSON data exported as a single long line; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist-cjs/submodules/client/index.native.js | AI (source-diff): CJS bundle output with readable source; standard build artifact for this package. | ai | |
| provenance | no-provenance | AI (provenance): AWS SDK packages historically publish without Sigstore provenance; publisher track record (9926 approved) provides sufficient trust signal. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): AWS SDK team rotation is expected for a large monorepo; publisher remains aws-sdk-bot (official AWS automation). No suspicious new maintainers added. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Cosmetic signals (short README, no keywords) are typical of AWS SDK monorepo sub-packages. Package has 41 approved dependents and clear legitimate purpose. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a declared runtime dependency used implicitly via TypeScript compilation output — the standard and documented usage pattern for tslib in TS projects. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require in scripts/lint.js loads the package's own package.json via path.join — a benign dev-script pattern, not runtime code. Stable false positive for this package. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @aws-sdk/core is a legitimate AWS SDK scoped package; the Levenshtein match to 'cors' is coincidental and not a typosquat attempt. | ai |
Versions (showing 1 of 201)
| Version | Deps | Published |
|---|---|---|
| 3.429.0 | 0 / 6 |