@radix-ui/react-use-callback-ref

Maintainerscaution

The package is organization-backed through workos.com, but hadihallak (gmail.com) and chancestrickland (chance.dev) use outside-domain publishing accounts, creating account-hygiene risk.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the package-to-source relationship is less transparent even though a Radix UI monorepo can legitimately contain subpackages.

Repo toolingcaution

The repository uses TypeScript, Vite, Vitest, and npm scripts, indicating a maintained build and test toolchain; no security-scanning tool was detected.

Security policycaution

No repository security policy was found, leaving vulnerability reporting guidance undocumented.

Workflow auditcaution

All four workflows were analyzed with no injection or high-severity findings, and one scopes permissions at job level. However, all eight action references are unpinned, which weakens workflow supply-chain reproducibility.