TypeScript Interface for Ethereum
88%
Total Score
healthy
Active, well-supported project with solid release transparency but meaningful GitHub Actions pinning and secret-scope gaps.
All 7 workflows were analyzed with no untrusted checkouts, script injection, or top-level write permissions. However, 26 of 32 action uses are unpinned, and two high-confidence medium-severity secrets-inherit findings expose broader-than-necessary credentials to reusable workflows.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-540380 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. viem is vulnerable to Denial of Service (DoS) in versions 0.1.0 - 2.53.1. | 0.1.0 - 2.53.1 | Medium |
AIKIDO-2024-10466 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. viem is vulnerable to Insufficient Entropy in versions 0.2.0 - 2.21.48. | 0.2.0 - 2.21.48 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
ox Version 0.14.56 | — | — |
ws Version 8.21.0 | — | — |
isows Version 1.0.7 | — | — |
abitype Version 1.2.3 | — | — |
@scure/bip32 Version 1.7.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.