graphql-tools

Maintainerscaution

The package has five publish-capable accounts, including two under the the-guild.dev domain, but urigo, kamilkisiela, and ardatan use Gmail accounts. Those consumer accounts are account-hygiene risk, not evidence of limited maintenance capacity.

Repo bus factorcaution

One contributor made about 68% of recent commits, creating concentration risk. Six other contributors were active during the same period, which partly offsets but does not remove that risk.

Workflow auditcaution

All four workflows were audited successfully with no reported findings, and no untrusted checkout or script-injection paths were found. However, 8 of 22 action references are unpinned and two workflows grant top-level write permissions, creating a mild hygiene concern without a demonstrated exploit path.