@walletconnect/ethereum-provider

Dependency profilecaution

Seven runtime dependencies, largely within the WalletConnect ecosystem, create meaningful dependency surface but remain a moderate profile for this provider package.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. Although a monorepo mismatch is ordinary, the lack of a README mention leaves some uncertainty that the repository directly represents this package.

Security policycaution

The repository has no SECURITY.md policy. This is a transparency gap for reporting vulnerabilities, although active security scanning partly offsets the concern.

Workflow auditcaution

All 29 action references are unpinned, which weakens reproducibility. The audit also reports high-confidence template-injection findings and one low-confidence cache-poisoning finding; no untrusted checkout or script-injection sink was found, so these remain workflow-hygiene concerns rather than a severe dependency risk.