awssdk — Greenflagged

This package exists to prevent typosquatting on the official AWS SDK for JavaScript (https://www.npmjs.com/package/aws-sdk)

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures No source commit

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

jsq

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
typosquat	typosquat.levenshtein:aws-sdk	AI (typosquat): This package is an intentional defensive placeholder to prevent typosquatting of aws-sdk, explicitly stated in package.json description. Not a malicious typosquat.	ai	2026/04/24
typosquat	typosquat.pattern:aws-sdk	AI (typosquat): Same rationale: package is a deliberate anti-typosquat guard, not an impersonation attempt. Stable across all versions.	ai	2026/04/24
bogus-package	bogus-package	AI (bogus-package): This is an intentional defensive typosquat placeholder. All bogus-package signals (no deps, empty main, no repo, tiny payload) are expected and benign for this package's stated purpose.	ai	2026/04/23
publish-pattern	rapid-publish	AI (publish-pattern): Rapid publish between v1.0.0 and v1.0.1 on a placeholder package with no material changes is benign; consistent with a minor correction by a trusted publisher.	ai	2026/04/23

Versions (showing 2 of 2)

Version	Deps	Published
1.0.1	0 / 0	2017-08-03
1.0.0	0 / 0	2017-08-03

v1.0.1

2 findings

HIGH Low-value / spam package indicators (6 signals, score 7) bogus-package

Matched 6 signal(s), weighted score 7: • [S_README_NO_CODE] Short README with no code block, no install instructions, and no usage/API section. • [S_NO_REPO_NO_HOME] No repository, homepage, or bugs URL — genuine packages almost always link somewhere. • [S_NO_KEYWORDS] No keywords declared. • [S_NO_DEPS] No runtime, dev, peer, or optional dependencies declared. • [S_TINY_PAYLOAD] Tiny payload: 1 code file(s), 555 bytes total. • [S_EMPTY_MAIN] Entry point (index.js) is 36 bytes — effectively empty.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.0.0

3 findings

HIGH typosquat.levenshtein: Possible typosquat of 'aws-sdk' typosquat

Package name 'awssdk' is 1 edit(s) away from popular package 'aws-sdk'.

HIGH typosquat.pattern: Suspicious name similarity to 'aws-sdk' typosquat

Package name 'awssdk' matches a known typosquatting pattern (hyphen swap, prefix/suffix) of 'aws-sdk'.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.