@trustwallet/wallet-core

wallet core wasm and protobuf models

Latest 4.8.4

86%

Total Score

healthy

Healthy: frequent releases and active contributors support this release despite a license mismatch and workflow hygiene issue.

Are you affected? Scan for Free

Health Score Breakdown

License

The manifest declares MIT, while the repository license file is detected as Apache-2.0; the mismatch creates a real licensing clarification concern despite the repository being licensed.

Workflow audit

All 13 workflows were analyzed without untrusted checkouts or script injection, and only 3 of 55 action references are unpinned. The high-confidence template-injection finding is a workflow hygiene concern, but no dangerous trigger or corroborating sink was reported.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-10544 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @trustwallet/wallet-core is vulnerable to Insufficient Verification of Data Authenticity in versions 2.0.0 - 4.6.5.	2.0.0 - 4.6.5	Medium
AIKIDO-2025-10974 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @trustwallet/wallet-core is vulnerable to Improper Input Validation in versions 2.0.0 - 4.4.4.	2.0.0 - 4.4.4	Medium
AIKIDO-2025-10862 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @trustwallet/wallet-core is vulnerable to Out-of-bounds Read in versions 3.1.34 - 4.4.2.	3.1.34 - 4.4.2	Low