@radix-ui/react-popper

Maintainerscaution

The organization-backed project has four registry maintainers, but hadihallak (gmail.com) and chancestrickland (chance.dev) publish outside the workos.com domain; this is an account-hygiene caution, not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @radix-ui/react-popper. Although a monorepo can legitimately host subpackages, this weakens direct transparency about the package’s source.

Repo toolingcaution

The repository uses TypeScript, Vite, Vitest, and npm scripts, indicating an established build and test toolchain. No security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The linked repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

All four workflows were analyzed with no injection or high-severity findings, and one scopes permissions at job level. However, all eight action references are unpinned, so workflow dependencies can change without a reviewable commit pin.