@babel/helper-remap-async-to-generator

Dangerous workflowscaution

Two workflows use pull_request_target, which warrants care because that trigger can expose elevated workflow context, but no untrusted checkouts or script-injection patterns were detected.

Repo package mentioncaution

The linked repository is a Babel monorepo and neither its name nor README explicitly identifies this package. That is understandable for a subpackage, but the missing explicit mention leaves a small package-to-repository transparency gap.

Repo toolingcaution

The repository uses established build tools and has a build process, but no security-scanning tools were detected. This is a minor hygiene gap, offset by the repository's active maintenance and separate security policy.

Token permissionscaution

Ten workflows declare read-only permissions, but two omit top-level permissions and one declares top-level write access, leaving some automation permission hygiene concerns.