@graphql-tools/wrap

Maintainerscaution

The package is backed by theguild.dev accounts, but publish access also includes urigo, ardatan, and enisdenjo under gmail.com addresses. With clear organization backing, these are account-hygiene concerns rather than evidence of limited maintenance capacity.

Repo package mentioncaution

The linked repository name does not match @graphql-tools/wrap and its README does not mention the package, so the package-to-source relationship is not clearly demonstrated. This is a genuine transparency concern even though monorepo naming differences can be ordinary.

Security policycaution

The repository has no security policy file, leaving vulnerability reporting and response expectations less transparent despite the presence of automated security scanning.

Workflow auditcaution

All six workflows were analyzed successfully; 21 of 66 action references are unpinned, which is a minor reproducibility gap. The single high-confidence template-injection finding is hygiene here because no untrusted checkout or dangerous trigger was reported.