Yep, that's the reasonable default position.

If however, the author of the code wrote a length article about how they'd developed this code while working for a company (not in their spare time), and you happen to read the article in question... then for that specific repo you might look at it differently.

The article in question doesn't clarify things regarding the Box derived code, nor whether they sought and received permission from Uber prior to publishing. Absent both of those, I'd personally not use code from this repo.

That's just me being risk-adverse here, as I don't personally have a use for the code. Others might make different choices. :)

You can assume whatever you want but the cops may not be very impressed.

There are a lot of polite fictions in law, and this is one of them. If you had no reasonable way of knowing that a license was invalid (or property was stolen), the judge is probably going to be sympathetic, but the property will still get returned to its proper owner.

If you DID have a reasonable way to know that the status of the property was suspect (as in this case), they are likely to take a dim view of the situation.