@react-native/babel-plugin-codegen

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package. The mismatch is consistent with a subpackage in the React Native monorepo, but the absence of a README mention leaves a small source-association transparency gap.

Repo toolingcaution

The repository uses Babel, TypeScript, and npm build tooling, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap.

Security policycaution

The linked repository has no security policy. This does not show abandonment, but it leaves vulnerability reporting and response expectations less explicit.

Version stabilitycaution

Version 0.87.1 is not a prerelease, but the package remains below 1.0 and all recent versions are marked as prerelease in the stability profile. That warrants some caution around API stability.

Workflow auditcaution

The audit covered 30 of 35 workflows and found no untrusted checkouts or script injections, but 122 of 133 action references are unpinned, with high-confidence template-injection findings, floating container images, archived actions, and inherited secrets. These are meaningful release-process hygiene concerns, though no direct trigger-and-sink path was reported.