@radix-ui/react-scroll-area

Maintainerscaution

The organization-backed project has two publish accounts using workos.com, but hadihallak (gmail.com) and chancestrickland (chance.dev) are outside-domain publishing identities, creating account-hygiene risk despite the company backing.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @radix-ui/react-scroll-area. This may be normal for a monorepo, but the missing README reference weakens package-to-source identification.

Repo toolingcaution

The repository uses TypeScript, Vite, Vitest, and npm scripts, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures.

Workflow auditcaution

All four workflows were analyzed successfully with no dangerous sinks or high-severity findings, but all 8 action references are unpinned. The lack of top-level permissions is not harmful here because one workflow uses job-level permissions and none grants top-level write access.