@ckeditor/ckeditor5-widget

Build provenancecaution

The package has no build attestation, so consumers receive less independently verifiable publication evidence; the trusted publisher identifier of CircleCI is a partial compensating signal.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package; although this can occur in a monorepo, the package-to-source relationship is less explicit.