@walletconnect/jsonrpc-types
The package is well-scaffolded for a TypeScript library, with MIT licensing, declarations, tests, and repository security tooling. Maintenance has gone quiet for over two years, and workflow publishing safeguards need attention before relying on future releases.
62%
Total Score
50
94
75
Health Score Breakdown
The package has 9 releases since July 2021, but its latest release was over two years ago and there were no releases in the last 12 months. This raises maintenance and abandonment concerns despite a previously regular release interval.
The linked repository recorded no commits and no active maintainers in the last three months. That supports the release-history concern, although the repository was pushed recently and is not archived.
All four workflows were analyzed, with no untrusted checkouts or script-injection findings, but seven of eight action references are unpinned and the audit found high-confidence template-injection patterns in publishing workflows. The trusted-publishing finding is informational in severity but still indicates publishing hygiene that warrants attention.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 events Version ^3.3.0 | — | — |
keyvaluestorage-interface Version ^1.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 2 years ago
- Created
- 5 years ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.