@babel/helper-environment-visitor

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap, not evidence that the release is unsafe.

Release historycaution

The package has 28 releases with a historical median interval of about 17 days, but it has had no release in the last two years since June 2024. Active repository work partly offsets the stale registry release cadence.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, which creates a repository-association transparency concern. The matching @babel namespace and Babel organization provide useful context but do not remove the mismatch entirely.

Repo toolingcaution

The repository uses established build tooling, but no security-scanning tools were detected. The separate security policy and active maintenance provide some compensation.

Workflow auditcaution

All 13 workflows were analyzed, but 119 of 120 action references are unpinned and high-confidence template-injection findings were reported; the low-confidence cache finding is only hygiene. The project also has an informational trusted-publishing finding, so workflow supply-chain hygiene is a real concern.