@babel/plugin-transform-named-capturing-groups-regex

Workflow auditdanger

The audit covered all 13 workflows, but 119 of 120 action references are unpinned, one workflow grants top-level write access, and high-confidence template-injection findings plus trusted-publishing usage weaken workflow hygiene. No untrusted checkout or script-injection sink was found, limiting the severity.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which is a transparency concern. Organization backing and the package's @babel namespace partly compensate because this is consistent with a monorepo subpackage.

Repo toolingcaution

The repository uses established build tooling, but no security scanning tools were detected. The separate security policy and workflow audit provide some compensation for that gap.