@radix-ui/react-accordion

Maintainerscaution

The package is organization-backed, with two publishers using the workos.com domain. hadihallak (gmail.com) and chancestrickland (chance.dev) are outside-domain publishing accounts, creating modest account-continuity risk.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which makes package ownership less explicit. The package is plausibly a monorepo component, so this is a limited transparency concern rather than a severe risk.

Repo toolingcaution

The repository uses established build and test tooling including Vitest, Vite, TypeScript, and npm scripts. No security scanning tools were detected, leaving a modest assurance gap.

Security policycaution

No repository security policy was found. This limits transparency around vulnerability reporting, though it is not evidence of unsafe code by itself.

Workflow auditcaution

All four workflows were analyzed without detected sinks or auditor findings, and one scopes permissions at job level. However, all eight action references are unpinned, weakening build reproducibility and exposing the workflow to action changes.