@radix-ui/react-navigation-menu

Maintainerscaution

Most publishing access is associated with workos.com, but hadihallak (gmail.com) and chancestrickland (chance.dev) are outside-domain accounts; this is an account-hygiene caution rather than evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, creating some uncertainty about package-to-repository mapping; the monorepo context makes the name mismatch ordinary, but the absent mention remains a caution.

Repo toolingcaution

The repository uses Vitest, Vite, TypeScript, and npm scripts, but no security-scanning tools were detected; the build tooling is solid while security-tool coverage is a modest gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

All four workflows were analyzed without high-confidence findings or dangerous untrusted triggers, but all 11 action references are unpinned; this is a workflow supply-chain hygiene gap, not a severe risk on its own.