@expo/cli

Build provenancecaution

No registry build attestation or trusted-publisher provenance is available, leaving publication origin less transparent despite the strong repository evidence.

Dependency profilecaution

The package declares 59 runtime dependencies, a sizable surface for a feature-rich CLI, but the profile is consistent with its broad native-tool orchestration role.

Maintainerscaution

The organization-backed package has 13 registry publishers, but seven consumer-domain accounts and four outside-domain accounts are account-hygiene concerns; active organizational development compensates for maintenance-capacity risk.

Workflow auditcaution

All 136 action references are pinned and no untrusted checkout or script-injection sink was found, but only 30 of 54 workflows were analyzed; high-confidence template-injection findings and high-confidence ad hoc package installs remain hygiene concerns.