@graphql-tools/documents

Repo bus factorcaution

The top contributor accounts for about 59% of recent commits, which is somewhat concentrated and creates a maintenance-capacity concern. This is partly offset by six other active contributors, so the net impact is caution rather than danger.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, which creates a transparency concern under this signal. The repository file tree nevertheless explicitly contains packages/documents source, tests, and package metadata, substantially reducing the risk that the package is unrelated.

Token permissionscaution

Two workflows lack top-level permissions and two declare top-level write access, which is weaker least-privilege hygiene than ideal. This is a supply-chain workflow caution, but no dangerous workflow behavior was detected.