The package is licensed, and its organization-backed source project remains active with tests, changelog coverage, and a security policy. However, this release has had no registry update since October 2017, while the linked repository does not identify the package clearly and its workflows mostly use unpinned actions.
55%
Total Score
100
100
83
83
50
No build attestation or trusted-publisher provenance was found, leaving publication origin less independently verifiable.
The package has 51 releases but none in the last 12 months; the latest release was published in October 2017, creating a substantial freshness and maintenance concern for this version.
The repository name does not match the package and its README does not mention it, so the package-to-source relationship is less transparent even though a monorepo can legitimately contain subpackages.
The project uses established build tooling, but no security-scanning tools were detected; the active organization and repository security policy provide partial compensation.
All workflows were analyzed and no untrusted checkouts or script-injection sinks were found, but 119 of 120 action references are unpinned and trusted publishing uses long-lived credentials, creating workflow hygiene and release-integrity concerns.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
babel-types Version ^6.24.1 | — | — |
babel-runtime Version ^6.22.0 | — | — |
babel-messages Version ^6.23.0 | — | — |
babel-template Version ^6.24.1 | — | — |
babel-traverse Version ^6.24.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.