Package Health/@graphql-tools/git-loader

@graphql-tools/git-loader

It includes types, provenance, tests, a changelog, and security tooling. Workflow permissions and publisher-account hygiene merit a little care.

Latest 8.0.44

NPM

85%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Maintainers

The package has five registry maintainers and a clear the-guild.dev publishing domain, but urigo, ardatan, and enisdenjo publish through Gmail accounts, creating account-continuity risk.

Repo package mention

The repository name does not match the package and its README does not mention this package. This may reflect a monorepo subpackage, but the missing explicit mention weakens package-to-repository transparency.

Workflow audit

All four workflows were analyzed with no audit findings or untrusted checkouts. Two workflows have top-level write permissions and 8 of 22 action references are unpinned, so workflow hygiene is not perfect.

Vulnerabilities

Title	Versions	Severity
CVE-2021-23326 @graphql-tools/git-loader is vulnerable to Improper Neutralization of Special Elements used in a Command ('Command Injection') in versions 0.0.0 - 6.2.6.	0.0.0 - 6.2.6	High

Package versions

Maintainers

Direct Dependencies

Dependency	Last Release	Score
tslib Version ^2.4.0	—	—
is-glob Version 4.0.3	—	—
unixify Version ^1.0.0	—	—
micromatch Version ^4.0.8	—	—
@graphql-tools/utils Version ^12.0.3	—	—