@ckeditor/ckeditor5-ckbox

Build provenancecaution

The package has no attestation, so consumers cannot independently verify its build provenance. A trusted publisher identifier of CircleCI provides some context but does not replace an attestation.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package. This is a caution because the package’s direct ownership relationship is less explicit, although the organization-backed monorepo context partly compensates.

Workflow auditcaution

No workflows were analyzed, with zero workflow files reported; this is not evidence of unsafe workflows, but it leaves CI workflow hygiene unassessed.