fontkit

Repo commit activitydanger

The repository had zero commits and zero active maintainers in the last three months, consistent with the release pause and the strongest abandonment concern in this assessment.

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving the release-to-source build path less transparent.

Dependency profilecaution

Nine runtime dependencies create meaningful maintenance surface area for a low-level font engine, though the profile is not unusually large on its own.

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding build-time behavior that consumers should understand, but this alone is not evidence of poor maintenance.

Maintainerscaution

Only one registry account has publish access, which creates a narrow publishing base. The organization-owned repository provides partial compensation, so this is not a severe concern.