@radix-ui/react-hover-card

Maintainerscaution

The package has four publishing accounts, with two using the organization domain; the gmail.com and chance.dev accounts are account-hygiene cautions, not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, creating some uncertainty about package-to-repository mapping; this is a caution even though the package may be a monorepo subpackage.

Repo toolingcaution

The project uses established build and test tooling, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

All four workflows were analyzed with no audit findings, no untrusted checkouts, and no script injection; however, all 8 action references are unpinned, which weakens build reproducibility.