@graphql-tools/delegate

Lifecycle scriptscaution

The package has a prepack script, which runs during packaging rather than ordinary dependency installation. It is a minor supply-chain transparency consideration, not evidence of a harmful install hook.

Repo package mentioncaution

The linked repository is graphql-hive/gateway, while the package is @graphql-tools/delegate, and the README does not mention the package. That weakens confidence that the repository is the package's actual home.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting expectations unclear. Active tooling and repository activity partly compensate, but do not remove this transparency gap.

Workflow auditcaution

All 6 workflows were analyzed and none uses untrusted checkout or script injection, but a high-confidence template-injection finding remains in examples.yml. The 21 unpinned references out of 66 are a minority and are not independently concerning.