@babel/plugin-transform-react-pure-annotations

Repo package mentioncaution

The linked Babel monorepo neither matches the package name nor mentions it in its README, so the package-to-repository association is less transparent than desirable despite the organization match.

Workflow auditcaution

The audit covered all 13 workflows with no untrusted checkouts or script-injection sinks, but 119 of 120 action references are unpinned. High-confidence template-injection findings and a low-confidence cache-poisoning finding add workflow hygiene concerns, while the informational trusted-publishing finding is not itself a material problem.