@apollo/federation-internals

Repo package mentioncaution

The repository name does not match the package and its README does not mention @apollo/federation-internals. This is plausible for a monorepo but leaves the package-to-source relationship less explicit.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected. This is a modest repository-hygiene gap rather than evidence of abandonment.

Workflow auditcaution

The single analyzed workflow grants top-level write permissions, uses all three actions without pinning, and has two high-confidence template-injection findings. No untrusted checkout or script-injection sink was detected, so these remain workflow-hygiene concerns rather than a standalone severe risk.