@fontsource-variable/geist

Repo package mentioncaution

The repository name does not match the package and its README does not mention this package. The organization-owned monorepo context makes a name mismatch ordinary, but the lack of a README mention still leaves package ownership less transparent.

Repo toolingcaution

No build tool or security scanning tool was detected. That weakens project hygiene evidence, although the package artifact itself is coherent and the workflow audit completed successfully.

Security policycaution

The repository has no security policy. This is a modest transparency gap for a maintained dependency, but it is not evidence of abandonment by itself.

Workflow auditcaution

All eight workflows were analyzed with no dangerous sinks or audit findings, but all 19 action references are unpinned and five workflows grant top-level write permissions. Without untrusted triggers, this is workflow hygiene risk rather than a severe supply-chain finding.