@react-native/babel-preset

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so the package-to-source association is less transparent; the organization-backed monorepo partly offsets that concern.

Repo toolingcaution

The project uses Babel, TypeScript, and npm build tooling, but the collected signal reports no security-scanning tools; this is a transparency and hygiene gap.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear despite strong maintenance activity.

Version stabilitycaution

Version 0.87.1 is not a prerelease, although the package remains below 1.0 and recent releases are marked as prerelease-heavy; this is a modest stability caveat rather than a major concern.

Workflow auditcaution

The audit found 24 high-confidence high-severity findings, including template injection and unpinned images, plus secrets inheritance and an archived action. No untrusted checkout or script-injection sink was found, but 108 of 117 action references are unpinned and only 30 of 36 workflows were analyzed.