It includes strong release activity, tested source, and npm provenance from an organization-backed project. Pin workflow references, verify the repository linkage, and note the missing security policy before adopting.
78%
Total Score
75
100
89
67
100
The package has four publishing accounts, with two using the organization domain. The gmail.com account hadihallak and chance.dev account chancestrickland are outside-domain publishing identities, creating account-hygiene caution despite the clear company backing.
One contributor made 93 of 94 recent commits, creating concentration risk. The second active contributor and organization ownership partly compensate, so this is not a severe abandonment signal.
The repository name does not match the package name and its README does not mention the package, so the linkage is less transparent. A monorepo can explain the name mismatch, but the missing README mention remains a caution.
The project uses Vitest, Vite, TypeScript, and npm scripts, and the repository tree shows tests; no security-scanning tool was detected, leaving a modest hygiene gap.
No security policy was found in the repository, reducing transparency about vulnerability reporting and response.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@radix-ui/react-id Version 1.1.4 | — | — |
@radix-ui/primitive Version 1.1.7 | — | — |
@radix-ui/react-context Version 1.2.2 | — | — |
@radix-ui/react-direction Version 1.1.5 | — | — |
@radix-ui/react-primitive Version 2.1.11 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.