@module-federation/inject-external-runtime-core-plugin

Repo package mentioncaution

The repository name does not match the package and its README does not mention this package, so the linkage is less transparent and should be verified.

Security policycaution

The linked repository has no published security policy, leaving vulnerability reporting and response expectations less transparent.

Version stabilitycaution

Version 2.9.2 is a stable major and not a prerelease, although 70% of recent releases were prereleases, indicating a somewhat experimental release stream.

Workflow auditcaution

All 26 workflows were analyzed and all 113 action references are pinned, but high-confidence template-injection findings and repeated high-confidence secrets-inherit findings create CI hygiene and credential-exposure concerns; the low-confidence cache finding and low-severity ad hoc install add little weight.