dunder-proto

Build provenancecaution

No registry build attestation or trusted-publisher information is available, so consumers have less evidence connecting the published artifact to its source. Repository tests, typings, and matching file trees partly compensate but do not eliminate this gap.

Dangerous workflowscaution

Two workflows use pull_request_target, which warrants caution because that trigger can expose privileged workflow behavior to pull requests. No untrusted checkouts or script-injection patterns were detected, limiting the severity.

Release historycaution

Only two releases were published, with the latest about 21 months ago and no releases in the last 12 months. The small, focused package may be stable, but the absence of newer releases limits evidence of ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the concern that maintenance has paused. The package's narrow scope and complete tests reduce, but do not remove, abandonment risk.

Repo issue activitycaution

There is only one open issue and no new or closed issues or pull requests in the last month. This is consistent with a small stable project but provides little evidence of active maintenance.