@aws-sdk/signature-v4
A standalone implementation of the AWS Signature V4 request signing algorithm
51
Versions
Apache-2.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
mattsb42-awskuheamzn-ossaws-sdk-bottrivikr-aws
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): @aws-sdk/types is a first-party AWS SDK core types package from the same monorepo, versioned identically. This pattern of internal dependency additions is expected and benign for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): mattsb42-aws is a known AWS employee; addition is consistent with normal AWS SDK team growth. Package is part of the official aws-sdk-js-v3 monorepo published by aws-sdk-bot. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): AWS SDK monorepo routinely rotates team members; aws-sdk-bot remains the publisher with a clean 29000+ approved package track record. Maintainer rotation is expected and not indicative of takeover. | ai | |
| dependencies | unvetted-dep:@aws-sdk/util-middleware | AI (dependencies): @aws-sdk/util-middleware is a sibling package in the AWS SDK v3 monorepo, published by the same trusted aws-sdk-bot publisher. This is a stable internal dependency with no security risk. | ai | |
| source-diff | encoded-string-file:dist-es/suite.fixture.js | AI (source-diff): The long encoded string is an AWS STS example security token in a SigV4 test fixture file — a well-known AWS test vector, not an obfuscated payload. Stable false positive for this package. | ai | |
| source-diff | obfuscated-file:dist-es/constants.js | AI (source-diff): False positive: long lines are inline TypeScript source maps (base64), not obfuscation. Standard AWS SDK build artifact. | ai | |
| source-diff | obfuscated-file:dist-cjs/credentialDerivation.js | AI (source-diff): False positive: long lines are inline TypeScript source maps (base64), not obfuscation. Standard AWS SDK build artifact. | ai | |
| source-diff | obfuscated-file:dist-es/credentialDerivation.js | AI (source-diff): False positive: long lines are inline TypeScript source maps (base64), not obfuscation. Standard AWS SDK build artifact. | ai | |
| source-diff | obfuscated-file:dist-cjs/getCanonicalQuery.js | AI (source-diff): False positive: long lines are inline TypeScript source maps (base64), not obfuscation. Standard AWS SDK build artifact. | ai | |
| source-diff | obfuscated-file:dist-es/getCanonicalQuery.js | AI (source-diff): False positive: long lines are inline TypeScript source maps (base64), not obfuscation. Standard AWS SDK build artifact. | ai | |
| source-diff | obfuscated-file:dist-cjs/constants.js | AI (source-diff): False positive: long lines are inline TypeScript source maps (base64), not obfuscation. Standard AWS SDK build artifact. | ai | |
| source-diff | obfuscated-file:dist-cjs/suite.fixture.js | AI (source-diff): False positive: long lines are inline TypeScript source maps (base64), not obfuscation. Standard AWS SDK build artifact. | ai | |
| source-diff | obfuscated-file:dist-es/suite.fixture.js | AI (source-diff): False positive: long lines are inline TypeScript source maps (base64), not obfuscation. Standard AWS SDK build artifact. | ai | |
| source-diff | large-new-source-files | AI (source-diff): New files are dual CJS/ES module build outputs added as part of AWS SDK v3 distribution structure change, not injected code. | ai | |
| source-diff | obfuscated-file:dist-es/headerUtil.js | AI (source-diff): False positive: long lines are inline TypeScript source maps (base64), not obfuscation. Standard AWS SDK build artifact. | ai | |
| source-diff | obfuscated-file:dist-cjs/SignatureV4.js | AI (source-diff): False positive: long lines are inline TypeScript source maps (base64), not obfuscation. Standard AWS SDK build artifact. | ai | |
| source-diff | obfuscated-file:dist-es/SignatureV4.js | AI (source-diff): False positive: long lines are inline TypeScript source maps (base64), not obfuscation. Standard AWS SDK build artifact. | ai | |
| source-diff | obfuscated-file:dist/es/headerUtil.js | AI (source-diff): File is standard TypeScript-compiled ES module output using tslib iterator helpers. The verbose try/catch/finally pattern is a known TypeScript compilation artifact, not obfuscation. Stable for this AWS SDK package. | ai | |
| provenance | no-provenance | AI (provenance): aws-sdk-bot publishes hundreds of packages without Sigstore provenance; this is consistent across the entire AWS SDK JS v3 release pipeline. | ai | |
| bogus-package | bogus-package | AI (bogus-package): AWS SDK monorepo utility packages routinely lack keywords and detailed READMEs; this is a structural pattern, not a spam indicator. | ai |
Versions (showing 51 of 99)
| Version | Deps | Published |
|---|---|---|
| 3.374.0 | 2 / 8 | |
| 3.370.0 | 8 / 8 | |
| 3.369.0 | 8 / 8 | |
| 3.357.0 | 8 / 8 | |
| 3.354.0 | 8 / 8 | |
| 3.347.0 | 8 / 8 | |
| 3.342.0 | 8 / 8 | |
| 3.341.0 | 7 / 8 | |
| 3.338.0 | 7 / 8 | |
| 3.337.0 | 7 / 8 | |
| 3.329.0 | 7 / 8 | |
| 3.310.0 | 7 / 8 | |
| 3.306.0 | 7 / 8 | |
| 3.303.0 | 7 / 8 | |
| 3.299.0 | 7 / 8 | |
| 3.296.0 | 7 / 9 | |
| 3.295.0 | 7 / 9 | |
| 3.292.0 | 7 / 9 | |
| 3.290.0 | 7 / 9 | |
| 3.289.0 | 7 / 9 | |
| 3.282.0 | 7 / 9 | |
| 3.272.0 | 7 / 9 | |
| 3.271.0 | 7 / 9 | |
| 3.267.0 | 7 / 9 | |
| 3.266.1 | 7 / 9 | |
| 3.266.0 | 7 / 9 | |
| 3.257.0 | 7 / 9 | |
| 3.254.0 | 7 / 9 | |
| 3.226.0 | 6 / 9 | |
| 3.224.0 | 6 / 9 | |
| 3.222.0 | 6 / 9 | |
| 3.215.0 | 6 / 9 | |
| 3.212.0 | 6 / 9 | |
| 3.208.0 | 6 / 9 | |
| 3.201.0 | 6 / 9 | |
| 3.200.0 | 6 / 9 | |
| 3.198.0 | 6 / 9 | |
| 3.197.0 | 6 / 9 | |
| 3.193.0 | 6 / 9 | |
| 3.190.0 | 6 / 9 | |
| 3.188.0 | 6 / 9 | |
| 3.186.0 | 6 / 9 | |
| 3.183.0 | 6 / 9 | |
| 3.178.0 | 6 / 9 | |
| 3.171.0 | 6 / 9 | |
| 3.170.0 | 6 / 9 | |
| 3.168.0 | 6 / 9 | |
| 3.163.0 | 6 / 9 | |
| 3.162.0 | 6 / 9 | |
| 3.160.0 | 6 / 9 | |
| 3.159.0 | 6 / 9 |