babel-plugin-syntax-hermes-parser

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable; the active organization-backed repository partly offsets this gap.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the package-to-repository relationship is not clearly demonstrated; this is a transparency caution despite the known Hermes monorepo context.

Workflow auditcaution

All 46 analyzed action references are unpinned, and the audit found high-confidence template-injection and floating-image findings plus a secrets-inherit finding. Workflows were fully analyzed and no untrusted checkout or script-injection trigger was reported, so this is a hygiene and hardening concern rather than a standalone severe dependency verdict.