76%
Total Score
healthy
The linked repository does not identify this package, and all eight workflow actions are unpinned.
The package has four registry publishers under organization backing, but hadihallak (gmail.com) and chancestrickland (chance.dev) use outside-domain accounts, creating account-hygiene caution despite the WorkOS-backed publisher base.
The linked repository name does not match the package and its README does not mention the package, so ownership of this specific package is less transparent; the mismatch may still be normal for a monorepo.
The repository uses TypeScript, Vite, Vitest, and npm scripts, but no security scanning tools were detected; the missing scanning is a modest hygiene gap rather than an abandonment signal.
No repository security policy was found, leaving vulnerability-reporting expectations unclear.
Version 0.2.0 is a stable release rather than a prerelease, but 75% of recent releases were prereleases, indicating some ongoing API or release-process churn.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@radix-ui/react-id Version 1.1.4 | — | — |
@radix-ui/primitive Version 1.2.0 | — | — |
@radix-ui/react-context Version 1.3.0 | — | — |
@radix-ui/react-primitive Version 2.2.0 | — | — |
@radix-ui/react-compose-refs Version 1.1.5 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.