@radix-ui/react-primitive

Maintainerscaution

The package is backed by the WorkOS organization, but hadihallak (gmail.com) and chancestrickland (chance.dev) use outside-domain publishing accounts, creating some account-hygiene risk despite the organizational backing.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the package-to-repository relationship is less explicit even though the organization backing is clear.

Repo toolingcaution

The repository uses Vitest, Vite, TypeScript, and npm scripts, with a defined build toolchain; no security scanning tools were detected, leaving a modest hygiene gap.

Security policycaution

No repository security policy was found, reducing transparency for vulnerability reporting and maintainer response expectations.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkout, script injection, or high-severity findings, and one scopes permissions at job level. However, all 8 action references are unpinned, creating a supply-chain reproducibility gap.