babel-plugin-transform-es2015-template-literals

Name lookalikedanger

The package is flagged as borrowing the identity of the much more established babel-plugin-polyfill-regenerator, and the detector reports explicit identity borrowing. Although artifact overlap is zero, this remains a serious consumer-confusion and supply-chain concern.

Release historydanger

The latest release was published in October 2017, nearly nine years ago, with no releases in the last 12 months. That strongly raises abandonment and compatibility risk despite the package's earlier frequent release cadence.

Repo package mentioncaution

The linked Babel repository neither matches the package name nor mentions it in its README, so the package-to-source relationship is not directly transparent. Its monorepo context reduces the concern somewhat, but does not remove the gap.

Workflow auditcaution

The audit analyzed all 13 workflows and found no untrusted checkout or script-injection path, but 119 of 120 action references are unpinned. It also reports high-confidence template-injection findings and trusted-publishing usage, which weaken workflow hygiene even though the low-confidence cache finding is only minor.