babel-plugin-polyfill-corejs2

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, so consumers cannot verify how this release was produced. This lowers transparency but does not by itself indicate an unsafe release.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, weakening direct ownership clarity; the package is nevertheless visible in the repository file tree as part of the monorepo.

Repo toolingcaution

The repository uses established build tools, but no security-scanning tools were detected. This is a modest transparency gap rather than evidence of abandonment.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear.

Workflow auditcaution

The single workflow was fully audited with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 11 action references are unpinned, which weakens build reproducibility and supply-chain control.