function-bind

Dangerous workflowscaution

Two of five workflows use pull_request_target, which warrants review because that trigger can expose elevated repository context; however, no untrusted checkouts or script-injection patterns were detected.

Release historycaution

The package has existed for more than 13 years with seven releases, but it has had no release in the last year; this is acceptable for a mature compatibility utility but still indicates limited recent maintenance.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with a quiet project and creating some abandonment risk despite the package's narrow, stable scope.

Repo toolingcaution

The repository reports no build tools or security scanning tools. The lack of build tooling is reasonable for this small JavaScript package, but the absence of security scanning is a modest transparency gap.

Repository archivedcaution

The linked repository is not archived, although its last push was nearly three years ago, which limits the reassurance this provides about current activity.