The package has a clear MIT license, tests, a changelog, release notes, and an organization-backed repository. It lacks a security policy, has no recent release activity, and all four workflow actions are unpinned.
64%
Total Score
100
100
89
67
The package has nine releases, but none in the last 12 months; its releases were clustered within about a day, suggesting maintenance has stopped since the initial release period.
The repository has zero stars, forks, and watchers, providing no community adoption evidence; this is supporting caution rather than proof of abandonment.
The repository has no security policy, leaving vulnerability-reporting expectations unclear for a library that handles blockchain interactions.
Both workflows were analyzed successfully with no dangerous audit findings or untrusted checkouts, but all four action references are unpinned, weakening build reproducibility and update safety. Missing top-level permissions blocks are acceptable on their own.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
web3p/web3.php Version ^0.1.6 | — | — |
guzzlehttp/guzzle Version ^7.2 | — | — |
kornrunner/secp256k1 Version ^0.3 | — | — |
simplito/elliptic-php Version ^1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.