@babel/plugin-transform-spread

Dangerous workflowscaution

Two of 13 workflows use pull_request_target, which warrants scrutiny because that trigger can expose elevated workflow context, but there were no detected untrusted checkouts or script-injection patterns.

Repo package mentioncaution

The linked repository neither matches the package name nor mentions it in its README, creating a package-to-source transparency concern. However, the Babel organization backing and monorepo structure make a subpackage relationship plausible, so this remains a caution rather than a severe risk.

Repo toolingcaution

The repository uses established build tooling and multiple build systems, but no security-scanning tools were detected; this is a modest transparency and security-hygiene gap.

Token permissionscaution

Most workflows use read-only permissions, but two lack top-level permissions declarations and one has top-level write permissions; this is a workflow-hygiene caution rather than evidence of unsafe behavior by itself.