Kodi – formerly called XBMC – is a totally legal, award-winning open source media player and entertainment hub (which you can download here). It’s gained popularity in recent times for its ability to download add-ons that can stream pirated content, but those that watch the copyrighted material may risk having their details exposed to anti-piracy groups.

One of the most popular third-party repositories for the add-ons, TVAddons, disappeared last month after being sued by a federal court in Texas for copyright infringement.

Earlier this week, TorrentFreak reported that several of the repository’s domain names were transferred to a Canadian law firm called DrapeauLex. A move that has set alarm bells ringing.

Exactly why this has happened remains unclear. Company lawyer Daniel Drapeau has not responded to requests for an explanation. What’s worrying is that former TVAddons users (there were 40 million of them in March) who haven’t wiped or upgraded their Kodi devices could be at risk of being spied on.

“If some malware author wanted, he could easily install a watcher that reports back the user’s IP address and everything they were doing in Kodi. If the law firm is actually an anti-piracy group, that seems like the likeliest thing I can think of,” said Kodi Project Manager Nathan Betzen.

This is a worst-case scenario, admittedly. DrapeauLex could be holding the domains in preparation for a sale, or it could be related to a lawsuit, but the company's refusal to answer questions is a concern. It’s worth noting that the domains remain dormant, but that could change.

Back in April, a ruling by the European Court of Justice stated that the sale of media players with links to copyrighted material is illegal. In the UK, there have been a number of recent arrests linked to “’fully-loaded” Kodi boxes as the government looks to crack down on the practice.