@storybook/blocks

Build provenancecaution

No build attestation or staged publishing is reported, leaving the connection between source and published artifact less transparent than it could be.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @storybook/blocks, creating some uncertainty about the package-to-repository link. The organization-backed monorepo context partly compensates for that concern.

Workflow auditcaution

All 19 workflows were analyzed with no high- or medium-severity findings, no unpinned action references, and no untrusted checkout or script-injection paths. Two high-confidence low-severity findings report package installation outside a lockfile, so workflow hygiene is not perfect.