@babel/plugin-transform-class-static-block

Dangerous workflowscaution

Two workflows use pull_request_target, which warrants workflow-security attention, but no untrusted checkouts or script-injection patterns were detected across the 13 analyzed workflows.

Repo package mentioncaution

The repository name differs from the package name, which is expected for a monorepo, but the README does not mention this package; that weakens direct package-to-repository transparency.

Repo toolingcaution

The repository uses established build tools and an explicit build system, but no security-scanning tools were detected; this is a repository hygiene gap rather than an abandonment signal.

Token permissionscaution

Most workflows declare read-only permissions, though two lack top-level permissions and one declares top-level write access; this is a permissions-hygiene caution mitigated by the broader read-only posture.