@graphql-codegen/typed-document-node

Repo bus factorcaution

Five contributors were active recently, but one supplied about 68% of commits. The other contributors and ongoing project activity reduce, but do not eliminate, concentration risk.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package. Although a monorepo can legitimately host subpackages, this leaves package-to-source ownership less explicit.

Repo toolingcaution

The repository uses TypeScript, Vitest, Babel, and npm scripts, showing a real build and test setup. No security-scanning tooling was detected, leaving a modest assurance gap.

Security policycaution

No repository security policy was found. This is a transparency and response-process gap, though active maintenance and provenance provide some compensation.

Workflow auditcaution

All six workflows were analyzed, all 25 action references were pinned, and no untrusted checkout or script-injection paths were found. However, the audit found a high-confidence archived action and trusted publishing, both workflow-hygiene concerns.