@react-pdf/font

Project backingcaution

The repository is owned by a user rather than an organization, so the single registry maintainer and concentrated ownership have less organizational continuity behind them.

Repo package mentioncaution

The repository name does not match @react-pdf/font and its README does not mention the package, creating uncertainty about whether the linked monorepo is specifically accountable for this release.

Repo toolingcaution

The project uses established build and test tooling, but no security scanning tools were detected, leaving a modest assurance gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and handling.

Workflow auditcaution

All 19 analyzed action references are unpinned, and the release workflow installs packages outside a lockfile; the findings are low-severity but high-confidence workflow hygiene concerns.