@ckeditor/ckeditor5-ckfinder

Build provenancecaution

No build attestation is present, which leaves publication provenance less independently verifiable; the CircleCI trusted publisher identity provides some compensating context but not an attestation.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention this package, creating a package-to-repository mapping ambiguity despite the matching organization ownership.

Workflow auditcaution

No GitHub Actions workflows were analyzed, so the audit provides no evidence about workflow security or pinning; this is an evidence gap rather than a finding of unsafe workflows.