@apollo/subgraph

Repo bus factorcaution

One contributor made 8 of 9 recent commits, creating concentration risk, though a second contributor remains active and the repository is organization-owned.

Repo popularitycaution

The repository reports only 1 star and 1 fork, so public popularity is limited; however, popularity is supporting evidence and the package has strong release and maintenance activity.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security-scanning tools were detected, leaving a modest hygiene gap.

Token permissionscaution

All 5 workflows lack top-level permission declarations, although none declares top-level write access and one specifies job-level permissions; explicit least-privilege defaults would improve workflow hygiene.