@babel/plugin-syntax-unicode-sets-regex

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable. This is a transparency limitation, partly offset by the established organization-backed repository.

Release historycaution

The latest release was published about 3 years and 5 months ago, with no releases in the last 12 months. This raises freshness and abandonment concerns, although the package is not deprecated and the source project remains active.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which weakens package-to-source transparency. The Babel organization backing makes a monorepo subpackage explanation plausible but does not remove the documentation gap.

Workflow auditcaution

All 13 workflows were analyzed, but 119 of 120 action references are unpinned and high-confidence template-injection findings were reported. Pull-request-target workflows have no observed untrusted checkout or script-injection sink, so this is a meaningful hygiene caution rather than a standalone severe risk.