@expo/config
A library for interacting with the app.json
74%
Total Score
caution
Active project with strong release and contributor health, but high-confidence workflow findings and incomplete audit coverage warrant caution.
Health Score Breakdown
The package has organization-linked publishing accounts, but several accounts use consumer or outside domains, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, wschurman, ide, bycedric, tsapeta, and philpl; organization backing partly compensates for this account-hygiene concern.
The repository name does not match @expo/config and its README does not mention the package, which creates some ownership-transparency uncertainty; the organization-backed monorepo context partly offsets that concern.
All 136 action references are pinned and there are no untrusted checkouts or script-injection findings, but 18 high-confidence template-injection findings remain across workflows; only 30 of 54 workflows were analyzed, so coverage is incomplete.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 glob Version ^13.0.0 | — | — |
getenv Version ^2.0.0 | — | — |
semver Version ^7.7.4 | — | — |
slugify Version ^1.3.4 | — | — |
deepmerge Version ^4.3.1 | — | — |
Weekly Downloads
Info
- Last Published
- 2 days ago
- Created
- 7 years ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.