@radix-ui/react-collection

Maintainerscaution

The company domain accounts fit the organization-backed project, but hadihallak (gmail.com) and chancestrickland (chance.dev) are outside-domain publishing identities and add account-hygiene risk.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @radix-ui/react-collection. This may be normal for a monorepo, but the package-to-source relationship is less transparent.

Repo toolingcaution

The repository uses established build and test tooling, but no security scanning tools were detected; this is a modest transparency gap rather than a maintenance failure.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance unclear despite the project's active maintenance.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkouts, script injection, or audit findings, but all 8 action references are unpinned, weakening build reproducibility and action-integrity protection.