@wordpress/block-library

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less verifiable than it could be. The active project and repository controls partly compensate for this gap.

Licensecaution

The artifact includes a license file, but its detected MPL-2.0, GPL-2.0 text does not fully match the declared GPL-2.0-or-later license. This is a transparency concern rather than an indication that the release is unlicensed.

Maintainerscaution

The package is backed by an organization, but many publishing accounts use consumer or outside domains, including gmail.com, pento.net, 10up.com, and wordpress.org. This is account-hygiene risk, not evidence of a small maintenance team.

Workflow auditcaution

All 27 workflows were analyzed, with read-only or job-level permissions in 26 and all 150 action references pinned. High-confidence template-injection findings and a high-confidence ad hoc package installation finding remain workflow hygiene concerns, although no untrusted checkout or script-injection sink was found.