call-bind-apply-helpers

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is recorded, so consumers have less verifiable evidence connecting the published artifact to its source.

Dangerous workflowscaution

Two workflows use pull_request_target, which requires careful handling because it can run with elevated repository context. No untrusted checkouts or script-injection patterns were detected, partially limiting the concern.

Maintainerscaution

Only one registry account has publish access. The matching repository and established project structure provide some compensation, but a single publisher creates a thinner operational base.

Release historycaution

There have been three releases over about 22 months, but none in the last 12 months; this suggests a mature or quiet package, while leaving current maintenance uncertain.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. The package is small and complete, but this still reduces confidence that issues or compatibility needs will be addressed promptly.