@graphql-tools/json-file-loader

Maintainerscaution

Five accounts can publish, but urigo, ardatan, and enisdenjo use consumer Gmail addresses rather than the primary the-guild.dev domain; this is an account-hygiene caution, not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package. The mismatch could be ordinary for a monorepo, but the lack of an explicit README reference leaves package ownership less transparent.

Workflow auditcaution

All four workflows were analyzed with no audit findings or untrusted checkouts. Two workflows have top-level write permissions and 8 of 22 action references are unpinned, creating a modest workflow-hygiene concern without an observed untrusted sink.