@babel/plugin-transform-classes

Dangerous workflowscaution

Two of 13 workflows use pull_request_target, which warrants review, but no untrusted checkouts or script-injection patterns were detected across the analyzed workflows.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package, creating a package-to-repository transparency concern; the organization and monorepo context reduce but do not eliminate it.

Repo toolingcaution

The repository uses established build tooling and multiple build systems, but no security-scanning tools were detected; the missing scanning is a CI hygiene gap, though other security signals partly compensate.

Token permissionscaution

Ten workflows declare read-only permissions, but two lack top-level permissions and one has top-level write permissions, leaving some least-privilege ambiguity.