Software Passport · public repository

bilbofroggins/KarabinerKeyboard

Observed by SPR on 2026-09-14 at commit 116b1256fdff0e2697ecfb4156bf346efb106b25 (main). Source: github.com/bilbofroggins/KarabinerKeyboard.

SBOM components18
Open findings32
Critical / high0 / 4
Evidence items22

What was observed

Syft generated the software bill of materials from the repository's manifests; each component was checked against the OSV vulnerability database; the tree was scanned for secrets, infrastructure-as-code issues and licence signals. Vendor-supplied attestations: none — this page contains only independent observation.

Open findings (top 25 of 32)

SeverityFindingComponentFixed in
HIGHGHSA-2xpw-w6gg-jr37urllib3@2.5.0
HIGHGHSA-qccp-gfcp-xxvcurllib3@2.5.0
HIGHGHSA-gm62-xv2j-4w53urllib3@2.5.0
HIGHGHSA-38jv-5279-wg99urllib3@2.5.0
MEDIUMLicense not observedurllib3
MEDIUMLicense not observedsetuptools
MEDIUMLicense not observedrequests
MEDIUMLicense not observedraylib
MEDIUMLicense not observedpyyaml
MEDIUMLicense not observedpywin32-ctypes
MEDIUMLicense not observedpyinstaller-hooks-contrib
MEDIUMLicense not observedpyinstaller
MEDIUMLicense not observedpycparser
MEDIUMLicense not observedpefile
MEDIUMLicense not observedpackaging
MEDIUMLicense not observedmacholib
MEDIUMLicense not observedkarabinerkeyboard
MEDIUMLicense not observedidna
MEDIUMLicense not observedcharset-normalizer
MEDIUMLicense not observedcffi
MEDIUMLicense not observedcertifi
MEDIUMLicense not observedaltgraph
UNKNOWNPYSEC-2026-1994urllib3@2.5.0
UNKNOWNPYSEC-2026-141urllib3@2.5.0
UNKNOWNPYSEC-2026-1998urllib3@2.5.0

Get the full passport

Continuous verification, evidence ledger, plain-English and auditor reports, and a shareable signed passport are available to SPR customers.

See plans   Review your own repository free

Software Passport Registry Ltd. Every number on this page was observed by SPR's own scan of the public repository at the commit shown; nothing is estimated or vendor-supplied. Absence of a finding is not proof of safety. Terms · Privacy