@storybook/core-events

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about package-to-repository linkage. The organization-owned monorepo context makes a subpackage explanation plausible, so this is only a caution.

Workflow auditcaution

All 19 workflows were analyzed with no untrusted checkout or script-injection findings, all 46 action references are pinned, and most workflows use read-only permissions. Two high-confidence low-severity adhoc-package findings are a minor reproducibility concern.