82%
Total Score
healthy
Active organization-backed project with strong release activity, but concentrated commits and unpinned CI actions reduce confidence.
One contributor made about 93% of the last three months' commits, creating concentration risk despite seven other active contributors and organizational backing.
The repository name does not match the package and its README does not mention the package, creating some uncertainty about package-to-repository ownership; the organization-backed monorepo context partly compensates.
The project uses TypeScript, Vite, Vitest, and npm scripts, but no security scanning tools were detected; this is a modest hygiene gap.
No repository security policy was found, leaving vulnerability-reporting expectations less transparent.
All four workflows were analyzed with no audit findings or untrusted checkouts, but all 11 action references are unpinned, weakening build reproducibility and supply-chain hygiene.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@radix-ui/primitive Version 1.2.0 | — | — |
@radix-ui/react-context Version 1.3.0 | — | — |
@radix-ui/react-use-size Version 1.1.5 | — | — |
@radix-ui/react-primitive Version 2.2.0 | — | — |
@radix-ui/react-compose-refs Version 1.1.5 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.