babel-loader

Build provenancecaution

No build attestation or trusted-publisher provenance is reported. This is a transparency gap for verifying how the published artifact was produced, although the repository and release history provide some compensating visibility.

Repo bus factorcaution

All recent commits came from one contributor, creating concentration risk. The repository belongs to an organization, which provides some capacity to hand maintenance off, but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating limited recent development activity. The recent release and repository push provide some compensation, but the maintenance pace is still a concern.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tool was detected. This is a modest hygiene gap rather than evidence that the package is unsafe or abandoned.

Workflow auditcaution

The single workflow was fully analyzed and uses read-only permissions, with no untrusted checkout or script-injection path. However, all five action references are unpinned and the audit found a high-confidence low-severity adhoc package installation, weakening CI reproducibility.