82%
Total Score
healthy
Active organization-backed project with strong release activity, but unpinned workflows and weak publishing/security hygiene add adoption risk.
The package is organization-backed, but hadihallak (gmail.com) and chancestrickland (chance.dev) publish outside the primary workos.com domain, creating account-continuity caution despite two company-domain maintainers.
The repository name does not match the package and its README does not mention @radix-ui/react-context. This may be expected for a monorepo, but the missing package mention leaves a small ownership-transparency gap.
The repository uses established build and TypeScript tooling, but no security scanning tools were detected; this is a modest hygiene gap rather than a dependency blocker.
No repository security policy was found, leaving the process for reporting vulnerabilities unclear.
All four workflows were analyzed with no detected injection or high-severity findings, but all eight action references are unpinned. The absence of top-level permissions is not itself a concern because one workflow uses job-level permissions and none has top-level write access.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.