call-bound

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent even though this does not by itself indicate an unsafe release.

Release historycaution

The package has five releases but none in the last 12 months, and its latest release was about 18 months ago, indicating materially slowed maintenance.

Repo commit activitycaution

There were no commits or active maintainers in the last three months, reinforcing the longer release gap and raising maintenance-risk concerns.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security-scanning tools were detected, leaving a modest review and maintenance gap.

Workflow auditcaution

All six workflows were analyzed with no audit findings and no untrusted checkouts or script injection, but all six action references are unpinned, creating avoidable automation supply-chain drift.