@itentialopensource/adapter-kafkav2
Itential adapter to connect to kafka
10
Versions
Apache-2.0
License
Yes
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
jared.obrienjohnpolanskyzack.strulovitchitential-ciandyknaebelishitaprakash
Keywords
ItentialItential PlatformAutomationIntegrationAdapterNotificationMessagingKafkav2Pre-Release
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): kafka-lz4-lite and kafkajs-snappy are Kafka compression codecs; contextually appropriate for a Kafka adapter. | ai | |
| provenance | no-provenance | AI (provenance): Established Itential org package; lack of Sigstore provenance is consistent across all versions and not a disqualifier here. | ai | |
| dependencies | unvetted-dep:kafka-lz4-lite | AI (dependencies): Legitimate Kafka compression codec library; expected dependency for a Kafka adapter. | ai | |
| dependencies | unvetted-dep:kafkajs-snappy | AI (dependencies): Legitimate KafkaJS Snappy compression plugin; expected dependency for a Kafka adapter. | ai | |
| dependencies | unvetted-dep:avro-schema-registry | AI (dependencies): Legitimate Avro schema registry client; expected for Kafka Avro serialization use cases. | ai | |
| phantom-deps | phantom-dep:mocha | AI (phantom-deps): mocha is a test runner referenced in scripts, not imported in source; stable false positive. | ai | |
| install-scripts | install-script:preinstall | AI (install-scripts): Itential adapter framework uses preinstall setup.js for hook registration; consistent across all adapter versions. | ai | |
| phantom-deps | phantom-dep:json-query | AI (phantom-deps): json-query used in adapter logic via config references; stable false positive for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic requires use path.join(__dirname, ...) with hardcoded relative paths — not user-controlled. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used in packaging utility (packModificationScript.js), not in runtime adapter code. | ai | |
| phantom-deps | phantom-dep:ajv | AI (phantom-deps): ajv is a declared dependency used via config/schema validation, not direct import; stable false positive. | ai | |
| phantom-deps | phantom-dep:avsc | AI (phantom-deps): avsc used indirectly via avro-schema-registry; stable false positive for this adapter. | ai |