@graphql-eslint/eslint-plugin

Release historycaution

The package has been published since 2020 with 889 releases, but only two releases appeared in the last 12 months. Recent repository activity partly offsets the slower registry cadence.

Repo package mentioncaution

The repository name differs from the package name and its README does not mention @graphql-eslint/eslint-plugin, so the package-to-repository link is less transparent than expected.

Repo toolingcaution

The project uses TypeScript, Turbo, npm scripts, and tsup, indicating an established build setup, though no security-scanning tooling was detected.

Security policycaution

No repository security policy was found. This is a transparency gap, though it is not evidence that the package is unsafe by itself.

Workflow auditcaution

All three workflows were analyzed with no dangerous sinks or audit findings, but seven of 12 action references are unpinned and one workflow grants top-level write access. The write permission is only a mild concern without an untrusted trigger or sink.