← Home

@pmndrs/msdfonts

npm Repository Homepage
14
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

abernierpmndrs01drcmdabjornstardennissmolekbela-bohlenderisaacmasonkrispyaa

Keywords

fontsuikiticonsthreejsr3fmsdf

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
source-diff obfuscated-file:dist/crimsonText.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/firaCode.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/inconsolata.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/inter.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/lato.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/libreBaskerville.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/merriweather.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/montserrat.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/nunito.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/openSans.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/playfairDisplay.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/poppins.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/raleway.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/roboto.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/sourceCodePro.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/spaceMono.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff obfuscated-file:dist/workSans.js AI (source-diff): Long lines are base64-encoded WebP font atlas data; expected for MSDF font distribution. ai
source-diff large-new-source-files AI (source-diff): New font files added as package expands its font catalog; consistent with package purpose. ai

Versions (showing 14 of 14)

Version Deps Published
1.0.74 0 / 0
1.0.73 0 / 0
1.0.72 0 / 0
1.0.71 0 / 0
1.0.70 0 / 0
1.0.69 0 / 0
1.0.68 0 / 0
1.0.67 0 / 0
1.0.66 0 / 0
1.0.64 0 / 0
1.0.63 0 / 0
1.0.62 0 / 0
1.0.61 0 / 0
1.0.60 0 / 0

v1.0.64

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.63

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.62

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v1.0.61

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: bela-bohlender → GitHub Actions (on 2026-01-15, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (bela-bohlender) on 2026-01-15, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.

v1.0.60

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.