babel-plugin-transform-es2015-typeof-symbol

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, leaving publication origin less verifiable; this is a supply-chain transparency gap, though not by itself evidence of an unsafe release.

Release historycaution

The package has 37 releases but none in the last 12 months, and its latest release was published in October 2017. That long release gap is a meaningful maintenance concern even though the source repository remains active.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so the package-to-source relationship is less transparent and may reflect a monorepo subpackage mapping.

Repo toolingcaution

The repository uses established build tooling, but no security-scanning tools were detected. The active project and security policy partly compensate for that tooling gap.

Workflow auditcaution

All 13 workflows were analyzed, but 119 of 120 action references are unpinned, creating substantial reproducibility and action-integrity risk. High-confidence template-injection findings are present, while no untrusted checkout or script-injection sink was detected; the trusted-publishing finding is informational in this audit.