@walletconnect/utils

Dependency profilecaution

Eighteen runtime dependencies create a meaningful maintenance surface, though the dependencies are largely scoped cryptographic, protocol, and WalletConnect components.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @walletconnect/utils, creating some uncertainty about package-to-repository linkage; the organization ownership and monorepo structure partly compensate.

Security policycaution

The repository has no published security policy, leaving disclosure and response expectations unclear despite the presence of security scanning tools.

Workflow auditcaution

All 11 workflows were analyzed, but 28 of 29 action references are unpinned and high-confidence template-injection findings appear in canary publishing workflows. The pull_request_target workflow is a different path, so these findings warrant caution rather than a severe verdict on their own.