This is a mature, actively maintained Babel package with 133 releases over more than 8 years, 13 releases in the last 12 months, a current stable major version, recent repository activity, and an organization-backed source repository. The package has an MIT license, bundled typings, repository tests and changelog coverage, npm provenance, no install-time scripts, and a non-archived repository with multiple active contributors. The main concerns are that the linked monorepo does not explicitly match or mention this package, repository security scanning was not detected, and some workflows lack top-level permissions declarations; these are meaningful transparency and CI-hygiene cautions but are outweighed by the strong maintenance, provenance, and project-backing evidence.
91%
Total Score
100
100
90
80
100
Two of 13 workflows use pull_request_target, which warrants review, but no untrusted checkouts or script-injection patterns were detected across the analyzed workflows.
The linked repository name does not match the package and its README does not mention the package, creating a package-to-repository transparency concern; the organization and monorepo context reduce but do not eliminate it.
The repository uses established build tooling and multiple build systems, but no security-scanning tools were detected; the missing scanning is a CI hygiene gap, though other security signals partly compensate.
Ten workflows declare read-only permissions, but two lack top-level permissions and one has top-level write permissions, leaving some least-privilege ambiguity.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@babel/traverse Version ^8.0.5 | — | — |
@babel/helper-globals Version ^8.0.0 | — | — |
@babel/helper-plugin-utils Version ^8.0.1 | — | — |
@babel/helper-replace-supers Version ^8.0.1 | — | — |
@babel/helper-annotate-as-pure Version ^8.0.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.