86%
Total Score
healthy
Active organization-backed project, but all workflow actions are unpinned and the repository does not identify this package.
The package is backed by an organization and two maintainers use the primary workos.com domain. hadihallak (gmail.com) and chancestrickland (chance.dev) use outside domains, creating account-hygiene caution but not evidence of limited maintenance capacity.
The repository name does not match @radix-ui/react-separator and its README does not mention the package, so the package-to-repository relationship is less transparent despite the shared organization ownership.
The repository uses TypeScript, Vite, Vitest, and npm scripts for builds and tests. No security scanning tools were detected, which is a minor hygiene gap.
The repository has no security policy, reducing transparency around vulnerability reporting and handling.
All four workflows were analyzed without high- or medium-severity findings, and no untrusted checkout or script-injection paths were detected. However, all 8 action references are unpinned, so workflow dependencies can change unexpectedly.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@radix-ui/react-primitive Version 2.2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.