🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Reviewing how the action is used in this repo and inspecting upstream changes between 6.1.1 and 6.1.3.
Verdict: benign

This is a routine patch bump of the official AWS-maintained action. The PR only changes the version pin in .github/workflows/build-riscv64.yml (6.1.1 → 6.1.3).

Upstream changes (v6.1.1 → v6.1.3) are security hardening, not compromise indicators

• 6.1.2: Adds symlink-aware file I/O (readFileUtf8, writeFileUtf8, mkdir) with O_NOFOLLOW to block symlink-based credential/profile reads.
• 6.1.3: Adds a narrow allowlist for Kubernetes kubelet projected service-account token paths (/var/run/secrets/*/serviceaccount/token), where symlinks are expected.
• Changes are covered by unit tests in test/helpers.test.ts (symlink refusal, kubelet allowlist, path normalization).
• No new preinstall/postinstall/install scripts in package.json; runtime scripts remain build/lint/test only.

Checklist — no malicious signals

Malware scanner (warn) — false positives

The scanner’s 945 heuristic hits disagree with a malicious interpretation:

• codepoint_decoder on charCodeAt() in bundled dist/*.js — normal HTTP/URL parsing in esbuild output, not hidden payload assembly.
• credential_exfil_indicator on CHANGELOG lines like “kubelet token symlink” — keyword + GitHub URL false match.
• maintainer_drift on 6.1.1→6.1.3 — expected for any version bump of an official action.

Dependency integrity

• Patch semver within v6; tags resolve correctly (d979d5b = v6.1.1, 99214aa = v6.1.3).
• Lockfile changes are routine @aws-sdk/* and dev-tool bumps; large dist/index.js churn is expected for this bundled action.
• Publisher remains AWS (Amazon.com, Inc. or its affiliates).

Recommendation: Approve from a supply-chain perspective. The update hardens filesystem handling and is appropriate for your release workflow that assumes an AWS role via OIDC. CI passing on build-riscv64.yml is sufficient validation for this consumer repo.

Compatibility Analysis

I'll locate every use of configure-aws-credentials in this repo and compare it to what changed upstream between 6.1.1 and 6.1.3.

Compatibility & adoption analysis

1) Where it’s used

Single usage site in this repo (excluding vendored .upstream-dependency):

      - name: Configure AWS credentials
        if: env.RELEASE == 'true'
        uses: aws-actions/configure-aws-credentials@v6.1.3
        with:
          role-to-assume: arn:aws:iam::${{ secrets.CHIA_AWS_ACCOUNT_ID }}:role/installer-upload
          aws-region: us-west-2

No other .github/workflows/* files reference this action. Not used in application/library code.

Usage pattern: GitHub OIDC (permissions: id-token: write) + role-to-assume. No web-identity-token-file, aws-profile, static keys, or role chaining.

2) Intersection with upstream changes (6.1.1 → 6.1.3)

Upstream diff shows no changes to action.yml inputs or the main OIDC entry path between these tags. Changed files: src/helpers.ts, src/assumeRole.ts (web-identity-token-file path only), src/profileManager.ts.

3) Risks / unknowns

• Low functional risk: Patch bump; your inputs are unchanged; changed code paths are not exercised by this workflow.
• Validation gap: The AWS step runs only when env.RELEASE == 'true'. PR CI will not hit it unless a release is published — merge confidence rests on upstream tests + unchanged OIDC contract.
• Security upside: 6.1.2 hardens against symlink-based credential reads; neutral for your OIDC flow.
• No build impact: CI-only dependency; no effect on chiavdf wheels/binaries.

4) Recommendation: merge

Routine patch bump of the official AWS-maintained action. Single-line pin change, no API/input changes, and your OIDC + role-to-assume usage does not intersect the filesystem/kubelet fixes. Safe to merge; optional post-merge check on the next release publish that the upload job completes S3 upload successfully.

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 14
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 1
• Resolved upstream range: d979d5b3a71173a29b74b5b88418bfda9437d885..99214aa6889fcddfa57764031d71add364327e59
• Resolved refs: from=d979d5b3a71173a29b74b5b88418bfda9437d885 to=99214aa6889fcddfa57764031d71add364327e59
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 945

Top findings

• dist/cleanup/index.js:844 codepoint_decoder :: const code = this.code = key.charCodeAt(index);
• dist/cleanup/index.js:866 codepoint_decoder :: const code = key.charCodeAt(index);
• dist/cleanup/index.js:1350 codepoint_decoder :: if (!isTokenCharCode(characters.charCodeAt(i))) {
• dist/cleanup/index.js:2814 codepoint_decoder :: for (let i = "A".charCodeAt(0); i <= "Z".charCodeAt(0); i++) {
• dist/cleanup/index.js:3420 codepoint_decoder :: if (data.charCodeAt(dataLength - 1) === 61) {
• dist/cleanup/index.js:3422 codepoint_decoder :: if (data.charCodeAt(dataLength - 1) === 61) {
• dist/cleanup/index.js:3502 codepoint_decoder :: while (lead < str.length && predicate(str.charCodeAt(lead))) lead++;
• dist/cleanup/index.js:3505 codepoint_decoder :: while (trail > 0 && predicate(str.charCodeAt(trail))) trail--;
• dist/cleanup/index.js:3869 codepoint_decoder :: if (x.charCodeAt(index) > 255) {
• dist/cleanup/index.js:3871 codepoint_decoder :: Cannot convert argument to a ByteString because the character at index ${index} has a value of ${x.charCodeAt(index)} which is greater than 255.
• dist/cleanup/index.js:4043 codepoint_decoder :: const code = url.charCodeAt(i);
• dist/cleanup/index.js:4069 codepoint_decoder :: const c = statusText.charCodeAt(i);
• dist/cleanup/index.js:4623 codepoint_decoder :: if (data.charCodeAt(position.position) !== 61) {
• dist/cleanup/index.js:4636 codepoint_decoder :: const code = char.charCodeAt(0);
• dist/cleanup/index.js:4650 codepoint_decoder :: if (data.charCodeAt(position.position) !== 45) {
• dist/cleanup/index.js:4663 codepoint_decoder :: const code = char.charCodeAt(0);
• dist/cleanup/index.js:4762 codepoint_decoder :: if (input.charCodeAt(position.position) === 34) {
• dist/cleanup/index.js:4771 codepoint_decoder :: assert(input.charCodeAt(position.position) === 44);
• dist/cleanup/index.js:5110 codepoint_decoder :: if ((chars.charCodeAt(i) & ~127) !== 0) {
• dist/cleanup/index.js:5122 codepoint_decoder :: const cp = boundary.charCodeAt(i);