@graphql-tools/utils

Maintainerscaution

Three publishing accounts use personal Gmail addresses—urigo, ardatan, and enisdenjo—while two use the the-guild.dev domain; this is an account-hygiene concern, not evidence of limited maintenance capacity.

Repo bus factorcaution

The top contributor made 67.9% of the 60 recent commits, while six others contributed; activity is healthy but still concentrated because the repository owner is an individual account.

Repo package mentioncaution

The repository name does not match this package and its README does not mention @graphql-tools/utils, so the package-to-repository association is less transparent; the mismatch may reflect a monorepo subpackage, but the collected evidence does not confirm that.

Workflow auditcaution

All four workflows were analyzed with no audit findings, no untrusted checkouts, and no script-injection paths. Two workflows have top-level write permissions and 8 of 22 action references are unpinned, which are modest workflow-hygiene concerns without an identified untrusted sink.