graphql-config

Build provenancecaution

No build attestation or trusted-publisher identity is present, so consumers receive no additional verification of how the artifact was produced.

Dependency profilecaution

The package has 11 runtime dependencies and no declared development dependencies. This is a meaningful dependency surface for a configuration library, but not by itself evidence of poor health.

Maintainerscaution

The repository is organization-owned, and two publishing accounts use the organization domain. The consumer-domain accounts urigo (gmail.com), kamilkisiela (gmail.com), and ardatan (gmail.com) create some account-hygiene risk, though they do not indicate maintenance capacity.

Repo toolingcaution

The repository uses TypeScript, Vitest, Rollup, Vite, and npm scripts, indicating a structured build and test setup. No security-scanning tools were detected.

Security policycaution

The repository has no security policy, leaving disclosure expectations undocumented. This is a transparency gap rather than evidence of abandonment.