nimiq/xpub

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern, although the recent January 2026 release provides some compensating evidence.

Repo toolingcaution

Composer is used for builds, but no security scanning tooling was detected. This reduces automated security transparency without showing that the package is unsafe.

Security policycaution

The repository has no security policy, leaving no documented channel or process for reporting vulnerabilities. This is a transparency and maintenance gap for a package handling public-key derivation.

Workflow auditcaution

All 2 analyzed workflow action references are unpinned, so their contents can change outside this repository. The workflow uses read-only permissions, has no untrusted checkout or injection findings, and the audit completed fully, which limits the severity.