@expo/code-signing-certificates

Build provenancecaution

No build attestation or trusted-publisher identity is provided, limiting publication transparency, though this is a provenance gap rather than evidence of unsafe code.

Maintainerscaution

The package is backed by the expo organization, which makes a short company-domain maintainer base expected; however, publish access also includes outside accounts such as ide (jameside.com), bycedric (bycedric.com), tsapeta (tsapeta.com), and philpl (kitten.sh), creating account-hygiene risk.

Repo commit activitycaution

The repository shows zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern despite the recent push and merged pull requests.

Repo toolingcaution

The repository uses TypeScript and npm scripts, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are not documented.