@module-federation/third-party-dts-extractor

Repo package mentioncaution

The repository name differs from the package and its README does not mention this package, so the package-to-source relationship is less transparent even though the organization-owned monorepo structure may explain the mismatch.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations and response guidance less transparent.

Workflow auditcaution

All 26 workflows were analyzed and actions are fully pinned, with no untrusted checkout or script-injection sink. However, high-confidence template-injection findings and repeated high-confidence secrets-inherit findings are meaningful workflow hygiene concerns; the low-confidence cache finding and low-severity ad hoc install add little weight.