Package Health

@taquito/taquito

TypeScript SDK for building wallets, dapps, and tooling on Tezos.

Latest 25.0.0NPMNPM

72%

Total Score

caution

Usable with caveats: strong release and packaging practices are offset by thin recent activity and fully unpinned workflow actions.

Are you affected? Scan for Free

Health Score Breakdown

Repo bus factorcaution

All 4 recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown in this period.

Repo commit activitycaution

Only 4 commits were made in the last 3 months by one active maintainer, which is thin recent activity despite the package's strong release history.

Repo issue activitycaution

The repository has 159 open issues, and no issues or pull requests were closed or merged in the last month, indicating unresolved maintenance pressure.

Workflow auditcaution

All 10 workflows were analyzed with no untrusted checkouts or script injections, and five use job-level or read-only permissions. However, all 41 action references are unpinned, weakening build reproducibility; the trusted-publishing finding is informational here.

Vulnerabilities

TitleVersionsSeverity
AIKIDO-2026-10108 Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
@taquito/taquito is vulnerable to Cross-Site Scripting (XSS) in versions 24.0.0 - 24.0.1.
24.0.0 - 24.0.1
Medium

Package versions

Direct Dependencies

DependencyLast ReleaseScore
rxjs
Version ^7.8.2
—
—
@taquito/rpc
Version ^25.0.0
—
—
bignumber.js
Version ^10.0.2
—
—
@taquito/core
Version ^25.0.0
—
—
@taquito/utils
Version ^25.0.0
—
—

Weekly Downloads

Info

Last Published
3 months ago
Created
7 years ago
Unpacked Size
2.1 MB

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform