@walletconnect/universal-provider

Repo package mentioncaution

The linked repository is a monorepo whose name does not match the package and whose README does not mention it. The name mismatch is normal for a subpackage, but the absence of a README mention leaves some package-to-repository transparency uncertainty.

Security policycaution

The repository has no published security policy. That is a transparency gap for a package involved in wallet and provider integrations, although active development and security tooling partly compensate.

Workflow auditcaution

All 11 workflows were analyzed, but 28 of 29 action references are unpinned, and high-confidence template-injection findings appear in canary publishing workflows. A low-confidence cache-poisoning finding is minor, but the publishing-workflow issues materially weaken supply-chain hygiene.