@module-federation/dts-plugin

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the package-to-source relationship is not clearly demonstrated. The organization backing helps, but does not remove this provenance gap.

Security policycaution

The repository has no security policy. That is a transparency and response-process gap, though active maintenance and security scanning partly compensate.

Workflow auditcaution

All 26 workflows were analyzed and action references are pinned, but high-confidence template-injection findings occur in a workflow using workflow_run, and high-confidence secrets-inherit findings expose broader credentials in a reusable workflow. These are meaningful CI security-hygiene concerns.