@radix-ui/react-avatar

Maintainerscaution

The primary publishing domain is workos.com and the project is organization-owned, but hadihallak (gmail.com) and chancestrickland (chance.dev) publish under outside domains. These are account-hygiene cautions, not evidence of maintenance capacity.

Repo bus factorcaution

One contributor made 106 of 114 recent commits, or about 93%, while the other seven contributors made only one or two each. Organization backing partly compensates, but the concentration remains a continuity risk.

Repo package mentioncaution

The linked repository is a monorepo whose name does not match the package, and its README does not mention @radix-ui/react-avatar. That makes package ownership less explicit, though the organization backing and package structure provide context.

Repo toolingcaution

The repository uses Vitest, npm scripts, Vite, and TypeScript for builds, but no security-scanning tools were detected. The missing scanning is a modest transparency gap.

Security policycaution

The repository has no security policy. This does not show unsafe code, but it leaves vulnerability-reporting and response expectations undocumented.