@babel/plugin-transform-sticky-regex

Dangerous workflowscaution

Two workflows use pull_request_target, which warrants care because that trigger can grant elevated repository context; however, no untrusted checkouts or script-injection patterns were detected in the analyzed workflows.

Repo package mentioncaution

The linked repository is the Babel monorepo, but neither its name nor README explicitly mentions this package. Organizational backing and the package namespace compensate for the ordinary monorepo name mismatch, though the lack of an explicit README mention leaves a small provenance-transparency gap.

Repo toolingcaution

The repository uses established build tools and a build system, but no security-scanning tools were detected. This is a modest transparency and defense-in-depth gap, not evidence of abandonment.

Token permissionscaution

Most workflows declare read-only permissions, but two lack top-level permissions and one declares top-level write access, leaving some workflow permission hygiene concerns.