@node-red/editor-api

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package's established release history.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which is a transparency concern; the package tree nevertheless places this module inside the Node-RED monorepo.

Workflow auditcaution

Both workflows were analyzed with read-only permissions and no untrusted checkout or script-injection paths. However, all 8 action references are unpinned, and the release workflow has a high-confidence insecure-commands finding; the low-confidence cache-poisoning finding is secondary.