@expo/config
A library for interacting with the app.json
88%
Total Score
healthy
Frequent releases and broad Expo repository activity outweigh minor workflow and publishing-account hygiene concerns.
Health Score Breakdown
No build attestation or trusted-publisher provenance is reported, leaving release origin less independently verifiable despite the package's strong maintenance evidence.
The package has 13 publishing accounts and is organization-backed, but several accounts use consumer or outside domains, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, wschurman, ide, bycedric, tsapeta, philpl; this is account hygiene caution rather than evidence of limited maintenance capacity.
The repository name does not match @expo/config and its README does not mention the package, which is a caution under the repository-linking check; the organization-owned Expo monorepo context makes a subpackage layout plausible.
All 136 analyzed action references are pinned and no untrusted checkout or script-injection sinks were found. However, only 30 of 54 workflows were analyzed, and high-confidence template-injection findings plus broad write permissions warrant workflow-hygiene caution.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 glob Version ^13.0.0 | — | — |
getenv Version ^2.0.0 | — | — |
semver Version ^7.6.0 | — | — |
slugify Version ^1.3.4 | — | — |
deepmerge Version ^4.3.1 | — | — |
Weekly Downloads
Info
- Last Published
- 6 days ago
- Created
- 7 years ago
- Unpacked Size
- 0.2 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.