babel-plugin-transform-async-to-generator

Release historydanger

The package has had no release in nearly nine years, despite 41 historical releases; this materially raises staleness and abandonment risk for the assessed version.

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent; the gap is meaningful but not independently severe.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so the linkage is not directly established. A monorepo mismatch can be normal, but the lack of a README mention remains a transparency concern.

Repo toolingcaution

The repository uses established build tools and has a security policy, but no security-scanning tools were detected. The policy helps, though it does not fully replace automated scanning.

Workflow auditcaution

119 of 120 action references are unpinned, and the audit found high-confidence template-injection patterns plus trusted publishing; these are workflow hygiene and credential risks, while the low-confidence cache finding is weaker evidence. No untrusted checkout or script-injection sink was detected for the pull_request_target workflows.