@aws-sdk/nested-clients
Nested clients for AWS SDK packages.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | encoded-string-file:dist-types/submodules/sts/commands/AssumeRoleCommand.d.ts | AI (source-diff): The long encoded string is a Base64 AWS STS SessionToken used as a JSDoc example in type declaration files — standard AWS SDK documentation, not a malicious payload. | ai | |
| bogus-package | bogus-package | AI (bogus-package): AWS SDK v3 submodule packages routinely have high semver (synced to monorepo), empty main (subpath exports used instead), no keywords, and minimal READMEs. Not indicative of spam. | ai | |
| phantom-deps | phantom-dep:@smithy/middleware-serde | AI (phantom-deps): Framework-scoped middleware package loaded by convention in AWS SDK middleware stack; not directly imported but legitimately declared. | ai | |
| phantom-deps | phantom-dep:@smithy/middleware-stack | AI (phantom-deps): Framework-scoped middleware package loaded by convention in AWS SDK middleware stack; not directly imported but legitimately declared. | ai |
Versions (showing 51 of 163)
| Version | Deps | Published |
|---|---|---|
| 3.997.13 | 10 / 4 | |
| 3.997.12 | 10 / 4 | |
| 3.997.11 | 10 / 4 | |
| 3.997.10 | 10 / 4 | |
| 3.997.9 | 10 / 4 | |
| 3.997.8 | 18 / 4 | |
| 3.997.7 | 18 / 4 | |
| 3.997.6 | 39 / 4 | |
| 3.997.5 | 39 / 4 | |
| 3.997.4 | 39 / 4 | |
| 3.997.3 | 39 / 4 | |
| 3.997.2 | 39 / 4 | |
| 3.997.1 | 39 / 4 | |
| 3.997.0 | 39 / 4 | |
| 3.996.21 | 38 / 4 | |
| 3.996.20 | 38 / 4 | |
| 3.996.19 | 38 / 4 | |
| 3.996.18 | 38 / 4 | |
| 3.996.17 | 38 / 4 | |
| 3.996.16 | 38 / 4 | |
| 3.996.15 | 38 / 4 | |
| 3.996.14 | 38 / 4 | |
| 3.996.13 | 38 / 4 | |
| 3.996.12 | 38 / 4 | |
| 3.996.11 | 38 / 4 | |
| 3.996.10 | 38 / 4 | |
| 3.996.9 | 38 / 4 | |
| 3.996.8 | 38 / 4 | |
| 3.996.7 | 38 / 4 | |
| 3.996.6 | 38 / 4 | |
| 3.996.5 | 38 / 4 | |
| 3.996.4 | 38 / 4 | |
| 3.996.3 | 38 / 4 | |
| 3.996.2 | 38 / 4 | |
| 3.996.1 | 38 / 4 | |
| 3.996.0 | 38 / 4 | |
| 3.995.0 | 38 / 4 | |
| 3.994.0 | 38 / 4 | |
| 3.993.0 | 38 / 4 | |
| 3.992.0 | 38 / 4 | |
| 3.991.0 | 38 / 4 | |
| 3.990.0 | 38 / 4 | |
| 3.989.0 | 38 / 4 | |
| 3.988.0 | 38 / 4 | |
| 3.987.0 | 38 / 4 | |
| 3.986.0 | 38 / 4 | |
| 3.985.0 | 38 / 4 | |
| 3.984.0 | 38 / 4 | |
| 3.983.0 | 38 / 4 | |
| 3.982.0 | 38 / 4 | |
| 3.981.0 | 38 / 4 |
v3.997.13
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.997.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.997.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.997.10
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.997.9
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.997.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.997.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.997.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.997.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.997.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.997.3
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v3.997.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.