76%
Total Score
healthy
Active organization-backed project with strong release history, offset by concentrated commits, unpinned workflow actions, and weak package-to-repository identi
The package has an organization-backed publishing domain, but hadihallak@gmail.com and chancestrickland@chance.dev are outside-domain publishing accounts, creating account-hygiene caution despite the WorkOS accounts.
Although eight contributors were active, one contributor made about 93% of recent commits. Organization backing and the other active contributors partly compensate, but the concentration remains a maintenance-continuity concern.
The repository name does not match the package and its README does not mention this package. While a monorepo mismatch is ordinary, the lack of a README mention leaves package ownership less directly verifiable.
The project uses established build and test tooling including Vitest, Vite, TypeScript, and npm scripts, but no security scanning tools were detected.
No repository security policy was found, leaving vulnerability reporting and disclosure expectations less transparent.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@radix-ui/primitive Version 1.2.0 | — | — |
@radix-ui/react-primitive Version 2.2.0 | — | — |
@radix-ui/react-compose-refs Version 1.1.5 | — | — |
@radix-ui/react-use-callback-ref Version 1.1.5 | — | — |
@radix-ui/react-use-effect-event Version 0.0.5 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.