@babel/plugin-transform-react-jsx-self

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, creating some package-to-repository ambiguity. The Babel organization-owned monorepo context makes a subpackage mismatch plausible, so this is only a caution.

Workflow auditcaution

All 13 workflows were analyzed with no untrusted checkout or script-injection paths, but 119 of 120 action references are unpinned, and the audit reports high-confidence template-injection findings plus trusted-publishing usage. These workflow weaknesses reduce build reproducibility and deserve caution, though they are not by themselves evidence that the release is unsafe.