82%
Total Score
healthy
Frequent releases and active repository work support this package; all workflow actions are unpinned and the linked monorepo does not name it.
The package has four publish-access accounts, but hadihallak uses gmail.com and chancestrickland uses chance.dev alongside the workos.com accounts; these create account-continuity concerns despite organizational backing.
The repository name does not match the package and its README does not mention it, creating some uncertainty about package-to-repository alignment. The monorepo structure makes a name mismatch understandable, but the missing README mention remains a transparency gap.
The repository uses established build and test tooling including Vitest, Vite, npm scripts, and TypeScript. No security scanning tool was detected, which is a modest hygiene gap.
No security policy was detected in the repository, reducing transparency for vulnerability reporting and coordinated response.
All four workflows were analyzed with no audit findings or unsafe untrusted checkouts, but all 8 action references are unpinned, weakening build reproducibility and action supply-chain control.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@radix-ui/number Version 1.1.3 | — | — |
@radix-ui/primitive Version 1.2.0 | — | — |
@radix-ui/react-context Version 1.3.0 | — | — |
@radix-ui/react-use-size Version 1.1.5 | — | — |
@radix-ui/react-direction Version 1.2.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.