babel-polyfill

Name lookalikedanger

The package borrows the identity of babel-plugin-polyfill-corejs3, which has far more monthly downloads and stable releases; the signal marks it as a copied identity rather than a transparent fork.

Release historydanger

The latest release was published in October 2017, with no releases in the last 12 months. The 42-release history shows past activity but does not offset the long release gap for this release.

Repo package mentioncaution

The linked Babel repository neither matches the package name nor mentions babel-polyfill in its README, so the package-to-repository relationship is not clearly established. Its monorepo context makes a name mismatch ordinary, but the missing mention remains a transparency concern.

Workflow auditcaution

The repository audit analyzed all 13 workflows and found no untrusted checkouts or script injections, but 119 of 120 action references are unpinned and trusted publishing uses a long-lived token pattern. High-confidence template-injection findings and the low-confidence cache finding add workflow hygiene concerns.