@babel/plugin-transform-class-properties

Dangerous workflowscaution

Two of 13 workflows use pull_request_target, which requires careful review because it can run with elevated repository context. No untrusted checkouts or script-injection patterns were detected, limiting the concern.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, which makes the package-to-repository mapping less explicit. The Babel organization and scoped namespace partly explain the monorepo layout, but the mapping should still be verified.

Repo toolingcaution

The repository uses established build tools and has a structured build system. It lacks detected security-scanning tools, a modest repository hygiene gap rather than evidence of abandonment.

Token permissionscaution

Most workflows declare read-only permissions, but two omit top-level permissions and one declares top-level write access. This is a workflow-hardening gap, though it is not accompanied by detected untrusted checkout or script-injection behavior.