@graphql-tools/json-file-loader

Maintainerscaution

Five publishing accounts are listed, with the primary domain tied to the project organization. The Gmail-based accounts urigo, ardatan, and enisdenjo are account-hygiene cautions, but they do not by themselves show limited maintenance capacity.

Project backingcaution

The package is published under the @graphql-tools namespace, but the linked repository owner is recorded as an individual rather than an organization. This provides less explicit organizational backing than an organization-owned repository.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it. That is a caution because the package could be difficult to verify, although the repository is clearly structured as a multi-package GraphQL Tools project.

Workflow auditcaution

All four workflows were analyzed with no audit findings, untrusted checkouts, or script injections. Eight of 22 action references are unpinned and two workflows grant top-level write access, creating minor workflow-hygiene concerns.