@boxyhq/internal-ui

Package scaffoldingcaution

The package includes a README and this version has release notes, but those notes describe Ory Polis and a different version lineage rather than the BoxyHQ UI package. Repository tests and the release notes otherwise provide some project documentation.

Repo package mentioncaution

The repository name does not match @boxyhq/internal-ui and its README does not mention the package, so the source may not belong to this release. A name mismatch can be normal for a monorepo, but the absence of any package mention makes this a real transparency concern.

Workflow auditcaution

All 31 analyzed action references are unpinned, the workflow has top-level write permissions, and high-confidence adhoc-package findings plus trusted-publishing findings were reported. The cache findings are low confidence and there is no untrusted checkout or script injection, so this is workflow hygiene risk rather than a severe standalone failure.