@babel/runtime

Repo package mentioncaution

The repository name does not match @babel/runtime and its README does not mention the package. This is a caution because the link is not explicit, although the organization-backed Babel monorepo context partly offsets the concern.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tools were detected. The repository's separate security policy and workflow audit provide some compensating transparency.

Workflow auditcaution

All 14 workflows were analyzed, with 11 using read-only permissions, but 119 of 188 action references are unpinned. High-confidence template-injection findings and use of long-lived publishing credentials add workflow hygiene and release-process risk; the low-confidence GITHUB_ENV and cache findings are weaker evidence.