78%
Total Score
healthy
Frequent releases and active organization backing outweigh concentrated commits, missing security policy, and unpinned workflow actions.
The package has organization-domain publishers, but hadihallak (gmail.com) and chancestrickland (chance.dev) are outside-domain publishing accounts. WorkOS backing partly compensates, making this an account-hygiene caution rather than a maintenance-capacity finding.
One contributor made 93 of 94 recent commits, creating concentration risk. The organization-owned repository and one additional active contributor partly compensate, so this is a caution rather than a severe abandonment signal.
The repository name does not match the package name and its README does not mention the package, which creates ownership ambiguity under this signal. The package is a component subpackage in a larger repository, which partly explains the mismatch but does not remove the signal's caution.
The project uses Vitest, Vite, TypeScript, and npm scripts, but no security scanning tools were detected. The build tooling is solid; the missing scanning is a modest hygiene gap.
No repository security policy was found, reducing transparency for vulnerability reporting and response.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@radix-ui/number Version 1.1.3 | — | — |
@radix-ui/primitive Version 1.1.7 | — | — |
@radix-ui/react-context Version 1.2.2 | — | — |
@radix-ui/react-use-size Version 1.1.5 | — | — |
@radix-ui/react-direction Version 1.1.5 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.