@ckeditor/ckeditor5-find-and-replace

Build provenancecaution

No build attestation is present, so consumers have less independently verifiable evidence connecting the published artifact to its build. The trusted publisher is identified as CircleCI, which partly offsets the gap.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. While monorepo subpackages commonly have different names, the missing explicit reference weakens package ownership transparency.

Version stabilitycaution

Version 49.0.0 is marked as a stable major and is not a prerelease, but the reported latest version is 48.5.2 and 95% of recent releases are prereleases, creating some version-state ambiguity.