babel-plugin-react-native-web

Build provenancecaution

The release has no build attestation or trusted-publisher configuration, leaving publication provenance less transparent than stronger supply-chain setups.

Repo toolingcaution

The project uses npm scripts and Babel, but no security scanning tools were detected. That is a transparency and hygiene gap, though active tests and review activity provide some compensation.

Security policycaution

No repository security policy was found. This reduces the documented process for reporting vulnerabilities, but it does not by itself show poor maintenance.

Type declarationscaution

No type declarations are published. This is a minor consumer-ergonomics gap for a JavaScript Babel plugin, not evidence of abandonment or unsafe maintenance.

Workflow auditcaution

All 14 analyzed action references are unpinned, and one workflow uses a high-confidence ad hoc package installation; one workflow also has top-level write permissions. No untrusted checkout or script-injection path was found, limiting the impact to workflow hygiene.