graphql-tag

Lifecycle scriptscaution

A prepublish lifecycle script is present, which adds some install and publication complexity, although the available evidence does not show a harmful action.

Repo bus factorcaution

All five recent commits came from one contributor, creating concentration risk; organization ownership provides some ability to hand maintenance off but does not remove the current single-contributor gap.

Repo commit activitycaution

Five commits landed in the last three months, so work continues, but all were made by one active maintainer.

Repo issue activitycaution

There were no new issues or closed issues in the last month and no pull requests merged, indicating limited recent maintenance activity despite one new pull request.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkouts, script injection, or write-all permissions. One high-confidence low-severity finding installs a package outside a lockfile, and two of five action references are unpinned, so release hygiene is not perfect but the issue is limited.