@walletconnect/core

Dependency profilecaution

Seventeen runtime dependencies create a meaningful transitive dependency surface, but the profile is consistent with a protocol core library and contains no development dependencies in the published package.

Security policycaution

The repository has no security policy file, leaving vulnerability reporting and response expectations less transparent despite its otherwise active maintenance.

Workflow auditcaution

All 11 workflows were analyzed, but 28 of 29 action references are unpinned, and high-confidence template-injection findings appear in canary publishing workflows; the separate low-confidence cache-poisoning finding is hygiene only because no untrusted checkout or script injection was reported.