kxk
kodi's tool kit
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:js/test/test.js | AI (source-diff): File is CoffeeScript-compiled test code (koffee compiler output). Long lines are an artifact of compilation, not obfuscation. Content is benign mocha test suite. | ai | |
| phantom-deps | phantom-dep:mocha | AI (phantom-deps): mocha is declared in dependencies and used for testing; phantom-dep pattern is normal for test tooling. | ai | |
| phantom-deps | phantom-dep:chokidar | AI (phantom-deps): chokidar is declared in dependencies and referenced in config; legitimate build/watch tool pattern. | ai | |
| phantom-deps | phantom-dep:isbinaryfile | AI (phantom-deps): Toolkit package legitimately uses isbinaryfile; phantom-dep finding is false positive for this package type. | ai | |
| phantom-deps | phantom-dep:pretty-time | AI (phantom-deps): Toolkit package legitimately uses pretty-time; phantom-dep finding is false positive for this package type. | ai | |
| phantom-deps | phantom-dep:html-entities | AI (phantom-deps): Toolkit package legitimately uses html-entities; phantom-dep finding is false positive for this package type. | ai | |
| phantom-deps | phantom-dep:textextensions | AI (phantom-deps): Toolkit package legitimately uses textextensions; phantom-dep finding is false positive for this package type. | ai | |
| npm-metadata | url-dep:source-map | AI (npm-metadata): The source-map URL dep points to the publisher's own GitHub fork (monsterkodi/source-map), consistent with intentional customization. Same author as the package; stable pattern across versions. | ai | |
| typosquat | typosquat.levenshtein:koa | AI (typosquat): kxk is the author's personal toolkit (monsterkodi), not a typosquat of koa. 293 versions and 3319 days of history confirm legitimacy. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decoding is used to parse inline source map data URIs — a standard, well-understood pattern with no malicious payload risk. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): kxk is a general-purpose toolkit; child_process use is expected and legitimate for its stated functionality. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require loads a resolved package.json path for metadata reading — standard pattern, not arbitrary module loading. | ai |
Versions (showing 100 of 293)
| Version | Deps | Published |
|---|---|---|
| 0.305.0 | 24 / 3 | |
| 0.304.0 | 23 / 3 | |
| 0.303.0 | 23 / 3 | |
| 0.302.0 | 22 / 3 | |
| 0.301.0 | 22 / 3 | |
| 0.300.0 | 22 / 3 | |
| 0.298.0 | 22 / 3 | |
| 0.297.0 | 22 / 3 | |
| 0.296.0 | 22 / 3 | |
| 0.295.0 | 22 / 3 | |
| 0.294.0 | 21 / 3 | |
| 0.293.0 | 21 / 3 | |
| 0.292.0 | 21 / 3 | |
| 0.290.0 | 21 / 3 | |
| 0.288.0 | 21 / 3 | |
| 0.287.0 | 21 / 3 | |
| 0.286.0 | 21 / 3 | |
| 0.285.0 | 21 / 3 | |
| 0.284.0 | 21 / 3 | |
| 0.283.0 | 21 / 3 | |
| 0.281.0 | 19 / 4 | |
| 0.280.0 | 18 / 4 | |
| 0.278.1 | 18 / 4 | |
| 0.278.0 | 18 / 4 | |
| 0.277.0 | 18 / 4 | |
| 0.233.0 | 17 / 2 | |
| 0.152.0 | 16 / 2 | |
| 0.150.0 | 16 / 2 | |
| 0.125.0 | 16 / 2 | |
| 0.124.0 | 16 / 2 | |
| 0.123.0 | 16 / 2 | |
| 0.122.0 | 16 / 2 | |
| 0.121.0 | 16 / 2 | |
| 0.120.0 | 16 / 2 | |
| 0.119.0 | 16 / 2 | |
| 0.118.0 | 16 / 2 | |
| 0.117.0 | 16 / 2 | |
| 0.116.0 | 16 / 2 | |
| 0.115.0 | 15 / 2 | |
| 0.114.0 | 15 / 2 | |
| 0.113.0 | 15 / 2 | |
| 0.112.0 | 15 / 2 | |
| 0.111.0 | 15 / 2 | |
| 0.110.0 | 15 / 2 | |
| 0.108.0 | 15 / 2 | |
| 0.107.0 | 15 / 2 | |
| 0.106.0 | 15 / 2 | |
| 0.105.0 | 15 / 2 | |
| 0.104.0 | 15 / 2 | |
| 0.103.0 | 15 / 2 | |
| 0.102.0 | 15 / 2 | |
| 0.101.0 | 15 / 2 | |
| 0.100.0 | 15 / 2 | |
| 0.99.0 | 15 / 2 | |
| 0.98.0 | 15 / 2 | |
| 0.97.0 | 15 / 2 | |
| 0.96.0 | 15 / 2 | |
| 0.95.0 | 15 / 2 | |
| 0.94.0 | 15 / 2 | |
| 0.93.0 | 15 / 2 | |
| 0.92.0 | 15 / 2 | |
| 0.91.0 | 15 / 2 | |
| 0.90.0 | 15 / 2 | |
| 0.89.0 | 15 / 2 | |
| 0.88.0 | 15 / 2 | |
| 0.87.0 | 15 / 2 | |
| 0.86.0 | 15 / 2 | |
| 0.85.0 | 15 / 2 | |
| 0.84.0 | 15 / 2 | |
| 0.83.0 | 15 / 2 | |
| 0.81.0 | 15 / 2 | |
| 0.80.0 | 15 / 2 | |
| 0.79.0 | 15 / 2 | |
| 0.78.0 | 15 / 2 | |
| 0.77.0 | 15 / 2 | |
| 0.76.0 | 15 / 2 | |
| 0.75.0 | 16 / 2 | |
| 0.74.0 | 16 / 2 | |
| 0.73.0 | 16 / 2 | |
| 0.72.0 | 16 / 2 | |
| 0.71.0 | 16 / 2 | |
| 0.70.0 | 16 / 2 | |
| 0.69.0 | 16 / 2 | |
| 0.67.0 | 16 / 2 | |
| 0.65.0 | 16 / 2 | |
| 0.64.0 | 16 / 2 | |
| 0.63.0 | 16 / 2 | |
| 0.62.0 | 16 / 2 | |
| 0.61.0 | 16 / 2 | |
| 0.60.0 | 16 / 2 | |
| 0.59.0 | 16 / 2 | |
| 0.58.0 | 16 / 2 | |
| 0.56.0 | 16 / 2 | |
| 0.55.1 | 16 / 2 | |
| 0.51.0 | 15 / 2 | |
| 0.50.0 | 15 / 2 | |
| 0.49.0 | 15 / 2 | |
| 0.48.0 | 14 / 2 | |
| 0.47.0 | 14 / 2 | |
| 0.46.1 | 14 / 2 |
v0.305.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.304.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.303.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.302.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.301.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.300.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.298.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.297.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.296.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.295.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.294.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.293.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.292.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.290.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.288.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.287.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.286.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.285.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.284.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.283.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.281.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.280.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.278.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.278.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.277.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.233.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.152.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.150.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.125.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.124.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.123.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.122.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.121.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.120.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.119.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.118.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.117.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.116.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.115.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.114.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.113.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.112.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.111.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.110.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.108.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.107.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.106.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.105.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.104.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.103.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.102.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.101.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.100.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.99.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.98.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.97.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.96.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.95.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.94.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.93.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.92.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.91.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.90.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.89.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.88.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.87.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.86.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.85.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.84.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.83.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.81.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.80.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.79.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.78.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.77.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.76.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.75.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.74.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.73.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.72.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.71.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.70.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.69.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.67.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.65.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.64.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.63.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.62.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.61.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.60.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.59.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.58.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.56.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.55.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.51.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.50.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.49.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.48.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.47.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.46.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.