No confirmed malicious attack surface. The explicit check command reads supplied package manifests to compare dependency versions.
Static reason
No blocking static signals were detected.
Trigger
User runs startup-mfe-compat check with package.json paths.
Impact
Reads specified manifest files; no package writes or network activity.
Mechanism
Local dependency compatibility analysis.
Rationale
Source inspection shows a user-invoked local CLI for microfrontend dependency checks. It has no install hook or concrete exfiltration, execution, persistence, or destructive behavior.
Evidence
package.jsonbin/index.jsdist/cli/commands/check.jsdist/utils/get-package-data.jsREADME.mddist/cli/index.js