@graphql-tools/graphql-tag-pluck

Maintainerscaution

The package has five publish-access accounts and a clear the-guild.dev domain, but urigo, ardatan, and enisdenjo publish from Gmail accounts. Those accounts are less durable for handover, so this is an account-hygiene caution rather than evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. The package is listed under a scoped namespace, so this may be a monorepo subpackage, but the linkage is less transparent than ideal.

Workflow auditcaution

All four workflows were analyzed with no reported audit findings, and no untrusted checkout or script-injection paths were found. However, 8 of 22 action references are unpinned and two workflows grant top-level write permissions, creating a mild hygiene concern without an untrusted trigger or sink.