@radix-ui/react-checkbox

Maintainerscaution

The package has four publish-access accounts, with two on the workos.com domain; hadihallak (gmail.com) and chancestrickland (chance.dev) are outside-domain accounts, creating account-hygiene caution, though organizational backing compensates for maintenance-capacity concerns.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @radix-ui/react-checkbox, so the package-to-repository relationship is less transparent. A monorepo can explain the name mismatch, but the missing README mention remains a caution.

Repo toolingcaution

The repository uses TypeScript, Vitest, Vite, and npm tooling, but no security-scanning tool was detected; the missing scanner is a modest hygiene gap.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear for dependents.

Workflow auditcaution

All 8 analyzed action references are unpinned, which weakens build reproducibility. The audit found no untrusted checkouts, script injection, high-severity findings, or top-level write permissions, so this is a hygiene caution rather than a severe workflow risk.