openhands-sdk

OpenHands SDK - Core functionality for building AI agents

Latest 1.61.0

PyPIMIT

82%

Total Score

healthy

Frequent releases and broad maintenance support this package, but its publishing workflows need attention.

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

The release has no build attestation or trusted publisher identity, so consumers cannot verify its build origin from the registry metadata.

Security policy

The repository has no security policy file.

Workflow audit

The PyPI publishing workflow uses a long-lived token, and integration-runner.yml checks out untrusted pull-request code while expanding untrusted input into shell commands. The audit analyzed 30 of 37 workflows, and 97 of 154 action references are not pinned to commits.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-788323 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. openhands-sdk is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 1.0.0 - 1.37.1.	1.0.0 - 1.37.1	Medium
AIKIDO-2026-33855 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. openhands-sdk is vulnerable to Exposure of Sensitive Information in versions 1.10.0 - 1.29.3.	1.10.0 - 1.29.3	Low
AIKIDO-2026-661702 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. openhands-sdk is vulnerable to Exposure of Sensitive Information in versions 1.12.0 - 1.20.0.	1.12.0 - 1.20.0	Medium
AIKIDO-2026-752802 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. openhands-sdk is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 1.0.0 - 1.28.1.	1.0.0 - 1.28.1	Medium
AIKIDO-2026-10853 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. openhands-sdk is vulnerable to Exposure of Sensitive Information in versions 1.1.0 - 1.22.0.	1.1.0 - 1.22.0	High

Package versions

Version	Published	Vulnerabilities
1.61.0	9 Nov 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.60.2	6 Nov 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.60.1	5 Nov 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.60.0	5 Nov 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.59.0	28 Oct 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.58.2	25 Oct 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.58.1	23 Oct 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.58.0	22 Oct 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.57.0	21 Oct 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total
1.56.0	19 Oct 2026	0 0 critical, 0 total 0 0 high, 0 total 0 0 medium, 0 total 0 0 low, 0 total

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
agent-client-protocol Version <0.13.0,>=0.12.1	—	—
certifi Version >=2026.10.19	—	—
deprecation Version >=2.1.0	—	—
fakeredis Version [lua]>=2.40.0	—	—
fastmcp Version <5,>=4.0.3	—	—