graphql-type-json

Build provenancecaution

The release has no build provenance attestation or trusted-publisher information, so consumers cannot verify how the published artifact was produced.

Lifecycle scriptscaution

A prepublish lifecycle script is present; this is a small operational concern because publication behavior is less explicit than a package without lifecycle hooks, but it is not severe on its own.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer reflects a relatively thin apparent backing.

Release historycaution

The package has existed since April 2016 with 13 releases, but its latest registry release was June 2020 and it had no releases in the last 12 months, indicating stale publication activity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, a meaningful sign of slowed maintenance despite the repository remaining available.