@module-federation/cli

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, creating uncertainty about package-to-repository ownership. The shared organization provides some context, but does not remove the linkage gap.

Security policycaution

The repository has no security policy. That is a transparency and vulnerability-reporting gap, though active maintenance and security scanning provide partial compensation.

Workflow auditcaution

All 26 workflows were analyzed and action references are fully pinned, with no untrusted checkouts or script-injection findings. However, high-confidence template-injection findings, repeated high-confidence secrets-inherit findings, and five workflows with top-level write permissions create meaningful CI hygiene concerns.