Package evidence

@cdklabs/[email protected]

Credential file access: matched "AWS_ACCESS_KEY"

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 1,667Niche · −30% score
Versions published: 51Mature · −50% score
First published: Jul 2022
Publisher: GitHub ActionsTrusted automation · −70% score

Effective trust discount applied: −70% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@cdklabs/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@cdklabs/[email protected]"],"fail_on":"review"}'

PublisherGitHub Actions

Artifact bytes10,137,314

Previous version0.0.63

Published2026-06-08T19:07:18.513Z

SHA-256d6f36483383c14b3625cbe339b4036d1c94badcaa1e511eb12c4b3fe7c8dbe0c

Why flagged

What the scanner saw

Credential file access: matched "AWS_ACCESS_KEY"

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

4d agoLast checked

reviewRisk

10Score

0.0.64Version

Status history (1 event)

new → available4d ago · risk review · score 10 · status changed

Evidence

Static findings

8 static · 0 from release diff · showing high-signal first.

No high-signal findings — see all findings below.

Show all 8 findings (low-signal and informational)

Severity	Kind	Path	Detail	Points
low	Credential file access	package/node_modules/@aws-sdk/credential-provider-node/dist-es/defaultProvider.js	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/node_modules/@aws-sdk/credential-provider-env/dist-es/fromEnv.js	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/node_modules/@aws-sdk/credential-provider-env/dist-cjs/index.js	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/node_modules/@aws-sdk/credential-provider-ini/dist-cjs/index.js	matched "aws_access_key"	5
low	Credential file access	package/node_modules/@aws-sdk/credential-provider-node/dist-cjs/index.js	matched "AWS_ACCESS_KEY"	5
low	Credential file access	package/node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveStaticCredentials.js	matched "aws_access_key"	5
low	Credential file access	package/node_modules/@aws-sdk/credential-provider-ini/package.json	matched ".aws/"	3
low	Credential file access	package/node_modules/@aws-sdk/credential-provider-process/package.json	matched ".aws/"	3

Manifest

Package metadata

Scripts30

buildnpx projen build
bumpnpx projen bump
clobbernpx projen clobber
compatnpx projen compat
compilenpx projen compile
defaultnpx projen default
docgennpx projen docgen
ejectnpx projen eject
eslintnpx projen eslint
integnpx projen integ
integ:updatenpx projen integ:update
packagenpx projen package
package-allnpx projen package-all
package:dotnetnpx projen package:dotnet
package:javanpx projen package:java
package:jsnpx projen package:js
package:pythonnpx projen package:python
post-compilenpx projen post-compile
post-upgradenpx projen post-upgrade
pre-compilenpx projen pre-compile
projennpx projen
releasenpx projen release
rosetta:extractnpx projen rosetta:extract
testnpx projen test
test:watchnpx projen test:watch
unbumpnpx projen unbump
upgradenpx projen upgrade
upgrade-cdklabs-projen-project-typesnpx projen upgrade-cdklabs-projen-project-types
upgrade-dev-depsnpx projen upgrade-dev-deps
watchnpx projen watch

Dependencies14

@aws-sdk/client-cloudformation^3.1063.0
@aws-sdk/client-cloudwatch^3.1063.0
@aws-sdk/client-ec2^3.1063.0
@aws-sdk/client-iam^3.1063.0
@aws-sdk/client-lambda^3.1063.0
@aws-sdk/client-s3^3.1063.0
@aws-sdk/client-sns^3.1063.0
@aws-sdk/client-sqs^3.1063.0
@aws-sdk/client-ssm^3.1063.0
immutable^4.3.8
js-yaml^4.2.0
jsonpath^1.3.0
python-shell^3.0.1
synchronized-promise^0.3.1