@metamask/assets-controllers
Controllers which manage interactions involving ERC-20, ERC-721, and ERC-1155 tokens (including NFTs)
88%
Total Score
healthy
Healthy, supported by frequent releases and substantial ongoing repository activity.
Health Score Breakdown
The package declares 46 runtime dependencies, including many related MetaMask controller packages. This is a substantial dependency surface, but it is coherent with the package's broad controller scope.
The package is backed by an organization, but three publishing accounts use gmail.com addresses (gudahtt, mcmire, naugtur) and mrten uses zuidhoorn.com. These are account-hygiene concerns, though organizational backing and active repository contributors reduce their impact on maintenance capacity.
All 12 workflows were analyzed with no audit findings, no untrusted checkout or script-injection paths, and mostly read-only or job-scoped permissions. However, 49 of 51 action references are unpinned, leaving a meaningful workflow supply-chain hygiene gap.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10344 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @metamask/assets-controllers is vulnerable to Client-Side Injection Attacks in versions 33.0.0 - 65.0.0. | 33.0.0 - 65.0.0 | Low |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 uuid Version ^11.1.1 | — | — |
bn.js Version ^5.2.5 | — | — |
immer Version ^11.1.18 | — | — |
reselect Version ^5.1.1 | — | — |
lodash-es Version ^4.18.1 | — | — |
Weekly Downloads
Info
- Last Published
- 11 days ago
- Created
- 3 years ago
- Unpacked Size
- 2.5 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.