@fortawesome/fontawesome-common-types

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so registry artifacts cannot be independently tied to a verified build. This is a modest transparency gap rather than evidence of unsafe content.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, which is a provenance and ownership clarity concern. The repository file tree does contain this package under its JavaScript packages, providing compensating context.

Security policycaution

The repository has no security policy, leaving reporting and response expectations undocumented. This is a transparency gap, though the package's other maintenance evidence partly offsets it.