@radix-ui/react-avatar

Maintainerscaution

The package is organization-backed, but hadihallak uses a Gmail account and chancestrickland uses chance.dev rather than the primary workos.com domain. These are account-hygiene concerns, not evidence of limited maintenance capacity.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention @radix-ui/react-avatar. Although a monorepo mismatch is ordinary, the missing README mention makes package ownership less transparent.

Repo toolingcaution

The repository uses established build and test tooling, but no security scanning tools were detected. This is a modest transparency and hygiene gap.

Security policycaution

No repository security policy was found, leaving the process for reporting vulnerabilities unclear.

Workflow auditcaution

All four workflows were analyzed without high-confidence findings or untrusted checkout/script-injection sinks, and one scopes permissions at job level. However, all 8 action references are unpinned, which weakens build reproducibility and supply-chain controls.