@vanilla-extract/babel-plugin-debug-ids

Build provenancecaution

The release has no build attestation or trusted-publisher provenance. This weakens publication transparency, but it is a hygiene concern rather than evidence that the package is unsafe to depend on.

Release historycaution

The package has had no registry release in over a year, despite 32 releases overall and a historically short median interval of about 5 days. Recent repository activity partly compensates, but the release gap lowers confidence in this specific version’s freshness.

Repo package mentioncaution

The repository name does not match the package and its README does not mention this package, so the package’s ownership relationship is less explicit. The organization-owned monorepo context partly explains the mismatch but does not remove the identification gap.

Security policycaution

The repository has no published security policy. This is a transparency gap for reporting and handling vulnerabilities, although the clean workflow audit and active organization backing provide some compensation.