@babel/plugin-transform-json-strings

Repo package mentioncaution

The repository name differs from the package and its README does not mention this package, which weakens direct ownership evidence. The Babel organization and monorepo context make a subpackage explanation plausible, but the direct linkage remains less transparent.

Workflow auditcaution

The audit covered all 13 workflows and found no untrusted checkout or script-injection counts, but 119 of 120 action references are unpinned. It also reported high-confidence template-injection findings and trusted-publishing usage, creating meaningful workflow hygiene concerns.