@expo/cli

Dependency profilecaution

The package has 63 runtime dependencies, a sizeable dependency surface for a CLI, but its broad functionality makes this proportionate rather than inherently concerning.

Maintainerscaution

The package has 13 registry publishers and clear organizational backing through the expo.io domain. The outside-domain accounts ide, bycedric, tsapeta, and philpl are account-hygiene cautions, though repository activity shows a much broader active contributor base.

Workflow auditcaution

All 136 analyzed action references are pinned, and the reported template-injection findings are high confidence; however, none share paths with the two pull_request_target workflows, so they remain workflow hygiene concerns rather than confirmed severe exposure. Only 30 of 53 workflows were analyzed, leaving coverage incomplete.