@module-federation/sdk

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package. That creates some uncertainty about package-to-repository correspondence, although the matching organization backing and substantial repository contents partly compensate.

Security policycaution

No repository security policy was found. That is a transparency gap for a widely integrated SDK, even though other maintenance and scanning evidence is positive.

Workflow auditcaution

All 26 workflows were analyzed and all 113 action references are pinned, but high-confidence template-injection findings, repeated high-confidence secrets-inherit findings, and an ad hoc package install remain workflow hygiene concerns. The pull_request_target and workflow_run triggers had no reported untrusted checkout or script-injection sink, so this is caution rather than a severe workflow risk.