@babel/plugin-syntax-import-attributes

Repo package mentioncaution

The linked Babel monorepo neither matches the package name nor mentions it in its README, so package ownership is less explicit even though the organization backing makes a monorepo relationship plausible.

Workflow auditcaution

All 13 workflows were analyzed, but 119 of 120 action references are unpinned and high-confidence template-injection findings appear in release-related workflows; the low-confidence cache finding is only a minor hygiene concern.