finesse/web-fonts-repository

Release historydanger

The package has had no release in more than 6 years: its latest release was in March 2020, despite eight releases earlier in its history. This materially raises abandonment risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the past 3 months. That supports the concern that maintenance has stalled, although the repository is not archived.

Security policycaution

The linked repository has no security policy. For a server-side webfont application, this is a transparency gap, though it is not evidence of a security flaw by itself.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection findings, but all 3 action references are unpinned and one high-confidence medium-severity finding identifies an archived action. The missing top-level permissions block is acceptable on its own.