Trust signals
Why this verdict
PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.
- Weekly downloads
- 17
- Versions published
- 24Established · −30% score
- First published
- Jun 2025
- Publisher
- amzn-oss
Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.
Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["@aws/[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["@aws/[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Obfuscation Density: high encoded/escaped-token density
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 103 · status changed
Evidence
Static findings
50 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/node_modules/esprima/dist/esprima.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/node_modules/aws-sdk/dist/aws-sdk-react-native.js | 12336955 bytes | 10 |
| medium | Large Javascript Payload | package/node_modules/aws-sdk/dist/aws-sdk.js | 7381864 bytes | 10 |
| medium | Large Javascript Payload | package/node_modules/aws-sdk/dist/aws-sdk.min.js | 3400490 bytes | 10 |
| medium | Credential file access | package/node_modules/@smithy/shared-ini-file-loader/dist-cjs/index.js | matched ".aws" | 10 |
| medium | Credential file access | package/node_modules/aws-sdk/lib/shared-ini/ini-loader.js | matched ".aws" | 10 |
| medium | Credential file access | package/node_modules/aws-sdk/lib/credentials/sso_credentials.js | matched ".aws" | 10 |
| medium | Credential file access | package/node_modules/aws-sdk/lib/token/sso_token_provider.js | matched ".aws" | 10 |
| medium | Large Javascript Payload | package/node_modules/xml2js/lib/xml2js.bc.js | 3391490 bytes | 10 |
Show all 50 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| medium | Obfuscation Density | package/node_modules/esprima/dist/esprima.js | high encoded/escaped-token density | 12 |
| medium | Large Javascript Payload | package/node_modules/aws-sdk/dist/aws-sdk-react-native.js | 12336955 bytes | 10 |
| medium | Large Javascript Payload | package/node_modules/aws-sdk/dist/aws-sdk.js | 7381864 bytes | 10 |
| medium | Large Javascript Payload | package/node_modules/aws-sdk/dist/aws-sdk.min.js | 3400490 bytes | 10 |
| medium | Credential file access | package/node_modules/@smithy/shared-ini-file-loader/dist-cjs/index.js | matched ".aws" | 10 |
| medium | Credential file access | package/node_modules/aws-sdk/lib/shared-ini/ini-loader.js | matched ".aws" | 10 |
| medium | Credential file access | package/node_modules/aws-sdk/lib/credentials/sso_credentials.js | matched ".aws" | 10 |
| medium | Credential file access | package/node_modules/aws-sdk/lib/token/sso_token_provider.js | matched ".aws" | 10 |
| medium | Large Javascript Payload | package/node_modules/xml2js/lib/xml2js.bc.js | 3391490 bytes | 10 |
| low | Credential file access | package/node_modules/aws-sdk/dist/aws-sdk-core-react-native.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/node_modules/aws-sdk/lib/credentials/ec2_metadata_credentials.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/credential-provider-env/dist-es/fromEnv.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/node_modules/@smithy/shared-ini-file-loader/dist-es/getConfigFilepath.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@smithy/shared-ini-file-loader/dist-es/getCredentialsFilepath.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@smithy/credential-provider-imds/dist-es/utils/getExtendedInstanceMetadataCredentials.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@smithy/shared-ini-file-loader/dist-cjs/getSSOTokenFilepath.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@smithy/shared-ini-file-loader/dist-es/getSSOTokenFilepath.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/credential-provider-env/dist-cjs/index.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/credential-provider-ini/dist-cjs/index.js | matched "aws_access_key" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/credential-provider-login/dist-cjs/index.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/credential-provider-node/dist-cjs/index.js | matched "AWS_ACCESS_KEY" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/credential-provider-sso/dist-cjs/index.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/util-endpoints/dist-cjs/index.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@smithy/credential-provider-imds/dist-cjs/index.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@smithy/node-http-handler/dist-cjs/index.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/aws-sdk/lib/metadata_service.js | matched ".AWS" | 5 |
| low | Credential file access | package/node_modules/@smithy/node-http-handler/dist-es/node-http-handler.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveStaticCredentials.js | matched "aws_access_key" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/client-dynamodb/dist-cjs/endpoint/ruleset.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/client-dynamodb/dist-es/endpoint/ruleset.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/signin/endpoint/ruleset.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/nested-clients/dist-es/submodules/signin/endpoint/ruleset.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/aws-sdk/scripts/services-table-generator.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/aws-sdk/lib/credentials/shared_ini_file_credentials.js | matched "aws_access_key" | 5 |
| low | Credential file access | package/node_modules/@aws-sdk/credential-provider-sso/dist-es/validateSsoProfile.js | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/aws-sdk/scripts/services-table-generator.ts | matched ".aws" | 5 |
| low | Credential file access | package/node_modules/aws-sdk/apis/batch-2016-08-10.examples.json | matched "id_rsa" | 3 |
| low | Credential file access | package/node_modules/aws-sdk/apis/email-2010-12-01.examples.json | matched ".aws" | 3 |
| low | Credential file access | package/node_modules/@aws-sdk/credential-provider-ini/package.json | matched ".aws" | 3 |
| low | Credential file access | package/node_modules/@aws-sdk/credential-provider-process/package.json | matched ".aws" | 3 |
| low | Credential file access | package/node_modules/@aws-sdk/util-endpoints/dist-cjs/lib/aws/partitions.json | matched ".aws" | 3 |
| low | Credential file access | package/node_modules/@aws-sdk/util-endpoints/dist-es/lib/aws/partitions.json | matched ".aws" | 3 |
| low | Credential file access | package/node_modules/aws-sdk/lib/region_config_data.json | matched ".aws" | 3 |
| low | Credential file access | package/node_modules/aws-sdk/apis/robomaker-2018-06-29.min.json | matched ".aws" | 3 |
| low | Credential file access | package/node_modules/aws-sdk/apis/route53-2013-04-01.examples.json | matched ".aws" | 3 |
| low | Credential file access | package/node_modules/aws-sdk/apis/securityhub-2018-10-26.examples.json | matched ".aws" | 3 |
| low | Credential file access | package/node_modules/aws-sdk/apis/sts-2011-06-15.examples.json | matched ".aws" | 3 |
| low | Credential file access | package/node_modules/universal-user-agent/.github/workflows/update-prettier.yml | matched "GITHUB_TOKEN" | 3 |
Manifest
Package metadata
Scripts17
acceptnpx projen acceptbuildnpx projen buildcompatnpx projen compatcompilenpx projen compiledefaultnpx projen defaulteslintnpx projen eslintpackagenpx projen packagepackage-allnpx projen package-allpackage:jsnpx projen package:jspost-compilenpx projen post-compilepost-upgradenpx projen post-upgradepre-compilenpx projen pre-compileprojennpx projentestnpx projen testtest:watchnpx projen test:watchupgradenpx projen upgradewatchnpx projen watch
Dependencies12
@aws-lambda-powertools/metrics^2.20.0@aws-sdk/client-dynamodb^3.777.0@aws-sdk/client-kms^3.777.0@aws-sdk/util-dynamodb^3.777.0@aws-smithy/server-apigateway^1.0.0-alpha.10@aws-smithy/server-common^1.0.0-alpha.10@aws/app-framework-for-github-apps-on-aws-ssdk^0.0.19@octokit/rest^21.1.1@octokit/types^14.0.0aws-lambda^1.0.7aws-xray-sdk^3.10.3re2-wasm^1.0.2