TypeScript SDK for building wallets, dapps, and tooling on Tezos.
72%
Total Score
caution
Usable with caveats: strong release and packaging practices are offset by thin recent activity and fully unpinned workflow actions.
All 4 recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown in this period.
Only 4 commits were made in the last 3 months by one active maintainer, which is thin recent activity despite the package's strong release history.
The repository has 159 open issues, and no issues or pull requests were closed or merged in the last month, indicating unresolved maintenance pressure.
All 10 workflows were analyzed with no untrusted checkouts or script injections, and five use job-level or read-only permissions. However, all 41 action references are unpinned, weakening build reproducibility; the trusted-publishing finding is informational here.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10108 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @taquito/taquito is vulnerable to Cross-Site Scripting (XSS) in versions 24.0.0 - 24.0.1. | 24.0.0 - 24.0.1 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
rxjs Version ^7.8.2 | — | — |
@taquito/rpc Version ^25.0.0 | — | — |
bignumber.js Version ^10.0.2 | — | — |
@taquito/core Version ^25.0.0 | — | — |
@taquito/utils Version ^25.0.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.