72%
Total Score
caution
Frequent releases and active project backing are offset by concentrated recent commits and weak workflow and security hygiene.
Two of four publishing accounts use the workos.com domain, while hadihallak (gmail.com) and chancestrickland (chance.dev) are outside-domain accounts. The organization backing makes a short registry list normal, but these account identities add publishing-account hygiene risk.
Recent work is highly concentrated: one contributor made 93 of 94 commits, or about 99%, while only two contributors were active. Organization backing partly compensates, but this remains a meaningful continuity risk.
The repository continues to receive issues and pull requests, with 15 new pull requests and 2 merged in the last month. The backlog of 208 issues and 158 open pull requests suggests slower resolution, but not inactivity.
The repository name does not match the package name and its README does not mention @radix-ui/react-select. This can be normal for a monorepo, but the missing README reference makes package-to-repository ownership less transparent.
The project uses established build and test tooling, including Vitest, Vite, npm scripts, and TypeScript. No security scanning tools were detected, leaving a modest security-process gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
aria-hidden Version ^1.2.4 | — | — |
@radix-ui/number Version 1.1.3 | — | — |
@radix-ui/react-id Version 1.1.4 | — | — |
@radix-ui/primitive Version 1.1.7 | — | — |
react-remove-scroll Version ^2.7.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.