@microsoft/kiota

npm package exposing Kiota CLI functionality to TypeScript

Latest 1.36.1

92%

Total Score

healthy

Frequent releases, active Microsoft-backed maintenance, and a matching repository outweigh limited workflow and provenance gaps.

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted publisher identity is present, leaving publication provenance less transparent than it could be. Strong repository ownership and active release evidence partly compensate, so this is a minor concern.

Workflow audit

All 15 workflows were analyzed and all 71 action references are pinned, with no untrusted checkouts or script-injection findings. High-confidence bot-condition, broad GitHub App permissions, and template-injection findings are workflow hygiene concerns, while the low-confidence-independent risk of untrusted execution is not demonstrated here.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-413518 @microsoft/kiota is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 1.32.4.	0.0.1 - 1.32.4	High
AIKIDO-2026-53015 @microsoft/kiota is vulnerable to Path Traversal in versions 0.0.1 - 1.32.4.	0.0.1 - 1.32.4	High
AIKIDO-2026-55303 @microsoft/kiota is vulnerable to Command Injection in versions 0.0.1 - 1.32.4.	0.0.1 - 1.32.4	Critical
AIKIDO-2026-686799 @microsoft/kiota is vulnerable to Path Traversal in versions 0.0.1 - 1.32.4.	0.0.1 - 1.32.4	Critical
AIKIDO-2026-161193 @microsoft/kiota is vulnerable to Path Traversal in versions 0.0.1 - 1.32.4.	0.0.1 - 1.32.4	Critical