@zag-js/aria-hidden

Build provenancecaution

No build attestation or trusted-publisher identity is present. This is a transparency weakness for release verification, but the active repository and release history provide compensating project evidence.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package. Because this is a subpackage in a broader repository, the mismatch is explainable, but the missing README mention leaves package ownership less explicit.

Repo toolingcaution

The repository uses established TypeScript, Vite, tsup, SWC, npm, and esbuild tooling. No security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy. That reduces disclosure transparency, but it does not indicate abandonment and is outweighed by the repository's active maintenance evidence.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts, script injection, or audit findings. However, 8 of 9 action references are unpinned and one workflow grants top-level write permissions, creating a workflow reproducibility and least-privilege weakness.