@graphql-tools/utils

Maintainerscaution

Five registry publishers provide continuity, but three accounts use personal Gmail addresses: urigo, ardatan, and enisdenjo. This is an account-hygiene caution rather than evidence of limited maintenance capacity.

Project backingcaution

The source repository is owned by a user account rather than an organization, so concentrated contribution activity does not receive organization-backed succession credit. Other signals still show eight active contributors and strong recent activity.

Repo package mentioncaution

The repository name does not match @graphql-tools/utils and its README does not mention the package, so the package-to-source relationship is less transparent than expected. The broader repository structure suggests a monorepo, but this signal still warrants caution.

Workflow auditcaution

All four workflows were analyzed with no audit findings or untrusted checkout and script-injection sinks. Two workflows grant top-level write permissions and eight of 22 action references are unpinned, creating mild workflow hygiene risk but not a severe concern.