@radix-ui/primitive

Maintainerscaution

The package is organization-backed, with two publish accounts on workos.com; hadihallak (gmail.com) and chancestrickland (chance.dev) are outside-domain accounts, creating a modest account-hygiene concern.

Repo package mentioncaution

The repository name does not match @radix-ui/primitive and its README does not mention the package, so the package-to-repository relationship is less transparent even though it may be a monorepo subpackage.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting expectations unclear.

Workflow auditcaution

All 8 analyzed action references are unpinned, which weakens build reproducibility. The audit found no untrusted checkouts, script injection, dangerous triggers, or high-severity findings, and the workflows had no top-level write permissions.