CLI (kolm npm package)
34 direct runtime deps. The verifier path uses only the node standard library; no third-party crypto.
| Package | Version | License |
|---|---|---|
| commander | 12.1.0 | MIT |
| chalk | 5.3.0 | MIT |
| ora | 8.0.1 | MIT |
| yauzl | 3.1.3 | MIT |
| tar-stream | 3.1.7 | MIT |
| node-fetch | 3.3.2 | MIT |
| js-yaml | 4.1.0 | MIT |
| open | 10.1.0 | MIT |
| + 26 more (download full list below) | ||
API server (railway)
23 direct runtime deps. Stripe SDK on a separate trust boundary.
| Package | Version | License |
|---|---|---|
| express | 4.21.1 | MIT |
| better-sqlite3 | 11.3.0 | MIT |
| stripe | 17.4.0 | MIT |
| jsonwebtoken | 9.0.2 | MIT |
| bcrypt | 5.1.1 | MIT |
| cors | 2.8.5 | MIT |
| helmet | 8.0.0 | MIT |
| + 16 more | ||
Trainer (Python)
30 direct deps. Pinned to a known-good index hash. Reinstall is reproducible from the receipt.
| Package | Version | License |
|---|---|---|
| torch | 2.5.1 | BSD-3-Clause |
| transformers | 4.46.3 | Apache-2.0 |
| peft | 0.13.2 | Apache-2.0 |
| trl | 0.12.1 | Apache-2.0 |
| datasets | 3.1.0 | Apache-2.0 |
| accelerate | 1.1.1 | Apache-2.0 |
| bitsandbytes | 0.44.1 | MIT |
| vllm | 0.6.3 | Apache-2.0 |
| + 22 more | ||
Get the full SBOM
The JSON file below is generated by Syft on every release and signed with the same key as the CLI binaries.
$ curl https://kolm.ai/sbom/kolm-cli-0.1.0.cdx.json $ curl https://kolm.ai/sbom/kolm-server-0.1.0.cdx.json $ curl https://kolm.ai/sbom/kolm-trainer-0.1.0.cdx.json # verify the signature $ cosign verify-blob \ --certificate kolm-cli-0.1.0.cdx.json.crt \ --signature kolm-cli-0.1.0.cdx.json.sig \ kolm-cli-0.1.0.cdx.json
Vulnerability monitoring is wired to /security. New CVEs against any package in this tree open a high-priority issue and a PR within 24 hours of disclosure.