Is this value a JS SharedArrayBuffer?
79%
Total Score
75
100
94
67
The package uses prepack and prepublish scripts. These are packaging-time hooks rather than install-time execution, so they add limited adoption concern but warrant awareness when reviewing the release process.
The package has had no registry release in about 21 months and none in the last 12 months, with five releases over roughly five and a half years. Recent repository activity provides some compensation, but the slow release cadence remains a maintenance caution.
There were no commits and no active maintainers in the three months measured. The recent push date and complete project scaffolding partly offset this short-term inactivity, but it still limits evidence of ongoing development.
All six workflows were analyzed successfully with no audit findings, no untrusted checkouts, and no script injection. However, all six action references are unpinned, which weakens build reproducibility even though permissions are not broadly writable.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
call-bound Version ^1.0.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.