babel-plugin-transform-exponentiation-operator

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less verifiable. This is a transparency weakness, but not severe on its own.

Release historycaution

The package has had no registry release for nearly nine years, despite 31 releases overall. This release is therefore mature but carries substantial staleness and abandonment risk.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so the link does not clearly establish that this repository publishes or maintains this specific package.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tools were detected. The security policy provides some transparency, though automated security coverage is not evident.

Workflow auditcaution

All 13 workflows were analyzed, but 119 of 120 action references are unpinned. High-confidence template-injection findings are hygiene concerns here because no matching untrusted checkout or script-injection sink was found; trusted publishing was also flagged, warranting caution.