@radix-ui/react-radio-group

Maintainerscaution

The package has four publish-access accounts, with two using the organization domain; the Gmail account hadihallak and outside-domain account chancestrickland create account-hygiene caution, though organizational backing compensates for concerns about publishing continuity.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating a transparency gap even though the organization-backed repository appears to be a monorepo.

Repo toolingcaution

The repository uses established build and test tooling including Vitest, Vite, TypeScript, and npm scripts. No security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

All four workflows were analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings, but all 8 action references are unpinned. Missing top-level permissions blocks are not concerning here because one workflow uses job-level permissions and none grant top-level write access.