babel-plugin-transform-es2015-spread

Release historycaution

The package has had no release in more than eight years, despite 35 releases overall. This strongly limits confidence that this specific release will receive fixes, although the long prior release history shows it was once maintained.

Repo package mentioncaution

The repository neither matches the package name nor mentions it in its README. Although name differences are normal for monorepo subpackages, this lack of an explicit mention leaves package ownership less transparent.

Repo toolingcaution

The repository uses established build tooling, but no security-scanning tools were detected. The active build setup compensates for much of this gap, making it a minor concern rather than a severe risk.

Workflow auditcaution

All 13 workflows were analyzed, but 119 of 120 action references are unpinned, and the audit found high-confidence template-injection findings plus a trusted-publishing concern. The pull_request_target workflows showed no untrusted checkout or script-injection sink, so these are workflow hygiene and release-process concerns rather than standalone evidence of an unsafe package.