@crossmint/wallets-sdk

Dependency profilecaution

The package declares 14 runtime dependencies, including cryptography, chain, and client SDK components. This is a substantial dependency surface but is reasonable for a multi-chain wallet SDK.

Maintainerscaution

Eight registry publishers support the package, and six share the primary paella.dev domain. The two Gmail-based accounts, pascualino and maxwellfortney, are account-hygiene cautions, though organization backing and active repository contributors compensate for limited registry-account evidence.

Repo toolingcaution

The project uses TypeScript, tsup, Turbo, and npm scripts, but no security-scanning tools were detected. That is a modest transparency and defense-in-depth gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations and disclosure guidance unspecified.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkouts or script injection, but 23 of 24 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence github-app finding reports blanket installation permissions. These are meaningful workflow supply-chain hygiene risks, though no untrusted trigger reaches them.