tkms
Key Management System for the Zama Protocol.
84%
Total Score
healthy
Healthy: frequent releases and active organization-backed development outweigh minor packaging and workflow concerns.
Health Score Breakdown
The package includes a LICENSE file and declares BSD-3-Clause-Clear, but the detected artifact license is BSD-3-Clause, so the mismatch creates a modest transparency concern.
The repository name does not match tkms and its README does not mention the package, so the package-to-source relationship is less transparent even though the organization-backed repository appears active.
All analyzed action references are pinned and workflows use read-only permissions, but high-confidence secrets-inherit findings and an ad hoc package install create workflow hygiene concerns. The low-confidence cache-poisoning finding is not treated as a severe risk on its own, and the audit covered 30 of 32 workflows.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10113 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. tkms is vulnerable to Uncontrolled Resource Consumption in versions 0.11.0 - 0.12.7. | 0.11.0 - 0.12.7 | Medium |
Package versions
Maintainers
Direct Dependencies
No direct dependencies.
Weekly Downloads
Info
- Last Published
- 12 days ago
- Created
- 2 years ago
- Unpacked Size
- 0.7 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.