@graphql-tools/graphql-file-loader

Maintainerscaution

Three publishing accounts use gmail.com addresses (urigo, ardatan, and enisdenjo), which is account-hygiene risk despite the primary the-guild.dev domain and five total publishers.

Project backingcaution

The repository is owned by a user account rather than an organization, so there is no explicit organizational handoff signal to offset contributor concentration.

Repo bus factorcaution

One contributor made 62.5% of recent commits, which is concentrated, but seven other contributors were active during the same three-month period.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, creating some uncertainty about the package-to-repository linkage; the package name mismatch can also occur for monorepo subpackages.

Workflow auditcaution

All four workflows were analyzed with no audit findings or untrusted checkouts. Eight of 22 action references are unpinned and two workflows have top-level write permissions, creating minor hygiene concerns without an observed exploit path.