@babel/plugin-transform-nullish-coalescing-operator

Repo package mentioncaution

The linked repository is the Babel monorepo rather than a name match, which is ordinary for a sub-package, but it neither names this package in its README nor matches its package name, leaving package ownership less explicit.

Workflow auditcaution

The audit analyzed all 13 workflows with no untrusted checkouts or script-injection findings, but 119 of 120 action references are unpinned and high-confidence template-injection findings remain hygiene concerns; the low-confidence cache warning carries little weight.