@module-federation/managers

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so the package-to-source relationship is not transparent; the shared organization provides some compensating context but does not remove the gap.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations unclear.

Workflow auditcaution

All 26 workflows were analyzed and all 113 action references are pinned, but high-confidence template-injection findings, repeated high-confidence secrets inheritance, and an ad hoc package install create workflow hygiene concerns. The cache-poisoning finding is low confidence, and no untrusted checkout or script-injection sink was reported.