@module-federation/data-prefetch

Package scaffoldingcaution

The package includes type declarations, tests and a changelog in the source project, but its 133-character README explicitly says the package is deprecated and recommends a data solution. That guidance materially lowers confidence for new dependencies.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package. A name mismatch can be normal for a monorepo, but the lack of an explicit package mention leaves ownership of this artifact less transparent.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, although active development and automated security scanning provide some compensation.

Workflow auditcaution

All 26 workflows were analyzed and all 113 action references are pinned, with no untrusted checkout or script-injection counts. However, high-confidence template-injection findings and repeated high-confidence secrets-inherit findings are meaningful workflow hygiene concerns; the low-confidence cache finding and low-severity ad hoc package install add little weight.