@module-federation/webpack-bundler-runtime

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention this package. Although a monorepo can legitimately host subpackages, this leaves package-to-source ownership less transparent.

Security policycaution

No repository security policy was found. This is a transparency gap for a package with substantial build and release infrastructure.

Workflow auditcaution

All 26 workflows were analyzed and all 113 action references are pinned, with no untrusted checkouts or script injections. However, high-confidence template-injection findings occur in a workflow_run workflow, high-confidence secrets-inherit findings are present, and the release workflow installs a package outside its lockfile, creating workflow hygiene concerns.