AWS SDK S3 (JS)
npm@aws-sdk/client-s3AWS SDK S3 Client for JavaScript is used in Node.js and serverless functions to read, write, and manage S3 objects. It is one of the most-used AWS SDK v3 packages in the JavaScript ecosystem, present in virtually every Node.js application that stores files on AWS. It resolves IAM credentials from environment variables, instance metadata, or the AWS credentials file.
Checking AWS SDK S3 (JS)
@aws-sdk/client-s3 3.629.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.
curl "https://api.attestd.io/v1/check?product=%40aws-sdk%2Fclient-s3&version=3.629.0" \
-H "Authorization: Bearer YOUR_API_KEY"{
"product": "@aws-sdk/client-s3",
"version": "3.629.0",
"supported": true,
"risk_state": "none",
"risk_factors": [],
"actively_exploited": false,
"remote_exploitable": false,
"authentication_required": false,
"patch_available": false,
"fixed_version": null,
"confidence": 0.9,
"cve_ids": [],
"cves": null,
"max_epss": null,
"typosquat": null,
"supply_chain_monitored": true,
"supply_chain": {
"compromised": false,
"sources": [],
"malware_type": null,
"description": null,
"advisory_url": null,
"compromised_at": null,
"removed_at": null
},
"last_updated": "2026-05-01T00:00:00Z"
}Why this package is monitored
@aws-sdk/client-s3 resolves IAM credentials before the first Get/Put. Credential theft can enable reading sensitive objects or writing attacker-controlled content into the same buckets.
Attestd monitors @aws-sdk/client-s3 using the following detection sources:
registryManually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.
osvOSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.
npm_deprecationnpm package versions with deprecation messages containing targeted attack language such as malicious, backdoor, or compromised. Confidence 0.80.