@edsdk/flmngr-ckeditor5

Build provenancecaution

Staged publishing is enabled, but the release has no build attestation or trusted-publisher identity, limiting verification of how the artifact was produced.

Licensecaution

The package declares GPL-2.0-or-later and includes a license file, but the detected file text is GPL-2.0, creating a license-scope mismatch worth checking before use.

Repo bus factorcaution

All recent commit activity comes from one contributor, increasing continuity risk; organization ownership provides some ability to hand maintenance off.

Repo toolingcaution

The project uses webpack and npm scripts, but no security-scanning tools were detected, leaving maintenance and vulnerability checks less transparent.

Security policycaution

The repository has no security policy, so there is no documented process for reporting or handling vulnerabilities.