@pdf-lib/standard-fonts

Release historydanger

The latest release was published on September 13, 2020, about 6 years before collection, with no releases in the last 12 months. This is the strongest maintenance concern for a dependency, even though the package may be stable and narrowly scoped.

Build provenancecaution

The release has no build attestation or trusted-publisher provenance. This weakens publication transparency, though it is not by itself evidence that the artifact is unsafe.

Project backingcaution

The repository is owned by a user account rather than an organization, so the single registry maintainer does not have organizational backing to compensate for the limited maintenance evidence.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, reinforcing the long release gap and indicating little recent maintenance capacity.

Repo toolingcaution

The project uses Make, TypeScript, and Rollup for builds, showing established build tooling, but no security scanning tools were detected. The tooling is a positive with a limited hygiene gap.