← Home

@tree-sitter-grammars/tree-sitter-kotlin

npm Repository Homepage
1
Versions
—
License
Yes
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

muniftanjimamaanqchronobserver

Keywords

incrementalparsingtree-sitterkotlin

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
install-scripts install-script:install AI (install-scripts): node-gyp-build is the standard prebuilt binary loader for tree-sitter native addons; stable for this package. ai
npm-metadata bundled-binaries AI (npm-metadata): Prebuilt .node files are the expected distribution mechanism for tree-sitter grammar bindings across platforms. ai
semgrep semgrep:dynamic-require AI (semgrep): Dynamic require is the documented bun/node-gyp-build platform-selection pattern for tree-sitter native bindings. ai
phantom-deps phantom-dep:node-addon-api AI (phantom-deps): node-addon-api is used at build time via binding.gyp, not directly imported in JS; stable false positive. ai
phantom-deps phantom-dep:npm-check-updates AI (phantom-deps): npm-check-updates is a dev/maintenance tool referenced in config, not imported in runtime JS; stable false positive. ai

Versions (showing 1 of 1)

Version Deps Published
1.1.0 3 / 4

v1.1.0

3 findings
HIGH Package has 'install' script install-scripts

Script: node-gyp-build

HIGH Bundled binary files (6) npm-metadata

Package contains compiled binaries that could be backdoors: • prebuilds/darwin-arm64/@tree-sitter-grammars+tree-sitter-kotlin.node • prebuilds/darwin-x64/@tree-sitter-grammars+tree-sitter-kotlin.node • prebuilds/linux-arm64/@tree-sitter-grammars+tree-sitter-kotlin.node • prebuilds/linux-x64/@tree-sitter-grammars+tree-sitter-kotlin.node • prebuilds/win32-arm64/@tree-sitter-grammars+tree-sitter-kotlin.node • prebuilds/win32-x64/@tree-sitter-grammars+tree-sitter-kotlin.node

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.