@storybook/theming

Repo package mentioncaution

The repository name does not match this package and its README does not mention @storybook/theming, so the package-to-repository relationship is less directly transparent; the organization-backed monorepo context partly offsets this.

Workflow auditcaution

All 19 workflows were analyzed with no high- or medium-severity findings, no unpinned actions, and no untrusted checkout or script-injection paths. Two high-confidence low-severity adhoc-package findings remain because workflows install packages outside a lockfile, which is a modest hygiene concern.