@babel/helper-validator-option

Repo package mentioncaution

The linked repository name differs from the package and its README does not mention this package. That is common for a monorepo, especially with Babel organization backing, but the exact package-to-repository mapping is less transparent.

Workflow auditcaution

The audit analyzed all 13 workflows with no untrusted checkout or script-injection path, and most workflows use read-only or job-level permissions. However, 119 of 120 action references are unpinned, creating a meaningful reproducibility and action-substitution hygiene gap; the reported trusted-publishing finding is informational and the cache-poisoning finding has low confidence.