82%
Total Score
healthy
Active organization-backed project with strong release history, but concentrated commits and unpinned workflows reduce confidence.
The package has four publishing accounts, with two on the workos.com domain and two outside it: hadihallak (gmail.com) and chancestrickland (chance.dev). Organization backing makes this primarily an account-hygiene caution rather than evidence of limited maintenance capacity.
Although eight contributors were active, one contributor made 92.98% of the 114 recent commits. Organization backing partly compensates for this concentration, but it remains a maintenance-continuity caution.
The repository name does not match the package and its README does not mention @radix-ui/react-toggle. A name mismatch is normal for a monorepo, but the missing README mention leaves package ownership somewhat less transparent.
The repository uses Vitest, Vite, TypeScript, and npm scripts for builds and tests. No security scanning tools were detected, which is a minor transparency gap for a mature project.
No repository security policy was found. This does not show a vulnerability, but it reduces the project's documented process for receiving and handling security reports.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@radix-ui/primitive Version 1.2.0 | — | — |
@radix-ui/react-primitive Version 2.2.0 | — | — |
@radix-ui/react-use-controllable-state Version 1.3.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.