radix-vue

Build provenancecaution

No build attestation or trusted publisher identity is present, so consumers cannot verify the artifact's build origin through registry provenance.

Release historycaution

The package has published 123 releases, but none in the last 12 months; the latest registry release was over 18 months ago. This is a meaningful freshness concern despite the historically regular cadence.

Repo toolingcaution

The project uses npm scripts and TypeScript, but no security-scanning tools were detected. This is a modest transparency and process gap.

Security policycaution

No repository security policy was found. For a widely consumed UI library, that leaves vulnerability reporting and response expectations less explicit.

Workflow auditcaution

All 16 analyzed action references are unpinned, and the audit found high-severity cache-poisoning with low confidence, high-confidence ad hoc package installation, and trusted publishing with a long-lived token. Two workflows also grant top-level write permissions.