@react-native/metro-babel-transformer

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention this package, leaving the package-to-source relationship insufficiently explicit even though a monorepo mismatch can be normal.

Security policycaution

No repository security policy was found, which is a transparency gap for a widely used build-related package.

Version stabilitycaution

Version 0.87.1 is not a prerelease, but the package remains below a stable major version and all recent releases are marked prereleases, adding some versioning uncertainty.

Workflow auditcaution

The audit found 122 of 133 action references unpinned, multiple unpinned container images, secrets-inherit findings, and high-confidence template-injection findings. No untrusted checkout or script-injection sink was reported alongside the listed pull_request_target or workflow_run triggers, so this is workflow hygiene risk rather than a severe standalone dependency verdict.