@ckeditor/ckeditor5-easy-image

Build provenancecaution

No build attestation is present, which leaves publication provenance less independently verifiable. The trusted publisher identity is recorded, but it does not replace an attestation.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, creating a package-linkage transparency concern. The organization-owned monorepo context partly explains the mismatch but does not remove it.

Version stabilitycaution

The assessed version is a stable major release and is not a prerelease. The reported latest version is older than the assessed version, creating a small metadata inconsistency, while the very high recent prerelease share warrants limited caution.

Workflow auditcaution

No GitHub Actions workflows were analyzed, so the audit found no workflow hazards but provides no evidence about CI workflow hygiene. This is a coverage limitation rather than a detected weakness.