hyperwallet/sdk
The repository is licensed, tested, and publishing stable releases, with organization backing and security scanning. Pinning automation dependencies would reduce build-integrity exposure before relying on automated builds.
68%
Total Score
75
100
100
63
Health Score Breakdown
A post-install-cmd script runs during installation, adding execution during dependency setup and therefore some supply-chain exposure, although this is not evidence of malicious behavior by itself.
The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern even though a release was published.
The repository has no published security policy, leaving vulnerability-reporting expectations and response guidance unclear for a security-sensitive API client.
All 11 analyzed action references are unpinned, and a high-confidence audit found a floating latest-tag container image in codeql.yml. The workflows have no untrusted checkout or script-injection findings, which limits the impact to build-integrity hygiene rather than a severe workflow risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Florian Krauthan |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 gree/jose Version ^2.2.1 | — | — |
guzzlehttp/guzzle Version ^6.2.1 || ^7.0.1 | — | — |
phpseclib/phpseclib Version ^2.0.11 | — | — |
Weekly Downloads
Info
- Last Published
- 1 day ago
- Created
- 10 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.