babel-plugin-syntax-object-rest-spread

Release historydanger

The package has had no registry release in nearly nine years, despite 31 releases overall. This is a meaningful freshness and abandonment concern for a dependency, although the linked organization repository remains active.

Repo package mentioncaution

The linked repository neither matches the package name nor mentions it in its README, so the package-to-repository relationship is not transparent. Its monorepo context reduces but does not remove that concern.

Workflow auditcaution

All 13 workflows were analyzed, but 119 of 120 action references are unpinned, and the audit reports a high-confidence trusted-publishing concern. The high-confidence template-injection findings have no reported untrusted checkout or script-injection sink, so they are hygiene concerns rather than severe standalone risks.