babel-helper-explode-assignable-expression

Build provenancecaution

No build attestation or trusted-publisher identity is recorded for this release, leaving publication provenance less transparent. The long-standing package and active organization repository provide partial context but not verifiable release provenance.

Release historycaution

The package has 46 releases but none in the last 12 months; its latest registry release was over eight years ago. The actively maintained source repository partly compensates, but this specific release is notably stale.

Repo package mentioncaution

The linked Babel monorepo neither matches the package name nor mentions it in its README, creating some uncertainty about package-to-repository mapping. The organization-backed monorepo context makes a subpackage relationship plausible but does not remove the gap entirely.

Repo toolingcaution

The project uses established build tooling, but the collected signal reports no security-scanning tools. The repository's other maintenance evidence partly compensates for that tooling gap.

Workflow auditcaution

All 13 workflows were analyzed with no untrusted checkout or script-injection sinks, but 119 of 120 action references are unpinned and the audit flags high-confidence template-injection patterns plus trusted-publishing usage. These are workflow hygiene and publishing risks, not evidence that the package itself is unsafe.