Usable with caveats: the package has clear documentation, tests, licensing, active recent commits, and organization backing. It is a brand-new 0.x release with no established release history, highly concentrated contribution, and limited repository security hygiene.
65%
Total Score
90
50
78
80
Five runtime dependencies, including the PHP and sodium requirements plus two cryptographic libraries and Guzzle, create meaningful dependency surface but are proportionate to an SDK handling networking and wallet functionality.
This is the first and only release, published less than one hour before collection, so there is no demonstrated release track record or long-term maintenance history.
One contributor made 18 of 19 recent commits, leaving maintenance highly concentrated; the second active contributor and organization backing provide only partial mitigation.
The repository has zero stars, forks, and watchers. This is weak supporting evidence, though the package is too new for low popularity to be decisive.
Composer build tooling is present, but no security-scanning tools were detected, leaving a security-process gap for an SDK that handles keys and signed transactions.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
guzzlehttp/guzzle Version ^7.8 || ^8.0 | — | — |
simplito/elliptic-php Version ^1.0 | — | — |
furqansiddiqui/bip39-mnemonic-php Version ^0.1.7 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.