@radix-ui/react-tooltip

Maintainerscaution

The package is organization-backed, but the publish-access list includes hadihallak at gmail.com and chancestrickland at chance.dev outside the primary workos.com domain; this is an account-hygiene caution, not proof of a thin maintenance team.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. This may reflect a monorepo, but the signal leaves package-to-repository linkage less explicit.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All 8 analyzed action references are unpinned, which weakens build reproducibility. The audit found no untrusted checkouts, script injection, dangerous triggers, or high-severity findings, and one workflow scopes permissions at job level.