Kotlin Open-Source Supply-Chain Review
Kotlin repository pattern findings, supply-chain review signals and scan coverage.
Report generated: 2026-11-14 17:29 UTC.
Primary repository language: Kotlin. 137 successful scans; 137 with a score, positive coverage and complete version metadata. Mean values are grouped by version; individual scores below are review prompts, not confirmed package incidents.
| Language | Scanned repos | Repos scored | Mean index / 100 | Schema / engine / scoring |
|---|---|---|---|---|
| Kotlin | 137 | 137 | 5.96 | 1.0.0 / 2.0.0 / heuristic-density-v1 |
Repository evidence
| Repository | Supply-chain index / 100 | Schema / engine / scoring | Lines scanned | Scan date |
|---|---|---|---|---|
| jay3-yy/BiliPai | 84.01 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 852,234 | 2026-10-31 |
| didi/booster | 79.18 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 35,450 | 2026-10-31 |
| permissionlesstech/bitchat-android | 65.87 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 158,425 | 2026-10-31 |
| shiaho777/web-to-app | 55.62 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 399,839 | 2026-10-31 |
| plainhub/plain-app | 47.26 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 202,589 | 2026-10-31 |
| JetBrains/ideavim | 35.56 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 373,274 | 2026-10-31 |
| Kotlin/kotlinx.coroutines | 34.74 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 131,205 | 2026-10-31 |
| sameerasw/essentials | 29.31 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 361,963 | 2026-10-31 |
| Aliucord/Aliucord | 23.16 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 25,619 | 2026-10-31 |
| EchoMusicApp/Echo-Music | 20.09 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 399,158 | 2026-10-31 |
| CeuiLiSA/Pixiv-Shaft | 15.79 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 404,271 | 2026-10-31 |
| androidx/androidx | 15.67 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 10,175,742 | 2026-10-31 |
| PixelPlayerHQ/PixelPlayer | 14.61 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 286,415 | 2026-10-31 |
| embabel/embabel-agent | 14.05 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 379,458 | 2026-10-31 |
| CYQawa/YunX | 11.30 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 98,028 | 2026-10-31 |
| square/kotlinpoet | 11.29 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 43,830 | 2026-10-31 |
| cwuom/NeriPlayer | 11.16 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 1,109,199 | 2026-10-31 |
| AAswordman/Operit | 9.82 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 801,949 | 2026-10-31 |
| utkarshdalal/GameNative | 9.54 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 575,752 | 2026-10-31 |
| d4rken-org/sdmaid-se | 8.64 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 524,866 | 2026-10-31 |
| JetBrains/kotlin | 8.47 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 6,855,065 | 2026-10-31 |
| ArchiveTuneApp/ArchiveTune | 8.19 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 287,150 | 2026-10-31 |
| rukamori/ArchiveTune | 8.19 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 287,150 | 2026-10-31 |
| sqldelight/sqldelight | 7.80 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 73,927 | 2026-10-31 |
| HapeLee/legado-with-MD3 | 7.06 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 901,252 | 2026-10-31 |
Pattern signals are prompts for human review, not proof of AI authorship, security vulnerabilities, missing packages, measured review time or code quality. Selection, scan coverage and scoring versions limit comparisons.