@expo/devtools

Build provenancecaution

No build attestation or trusted publisher identity is present, so consumers cannot independently verify how the registry artifact was produced. This is a supply-chain transparency gap, but it is partly offset by the active, organization-owned repository and established build tooling.

Token permissionscaution

Twenty-four analyzed workflows lack top-level permissions and six grant top-level write access, while none are reported as read-only. This is weaker workflow permission hygiene, though it is repository-level evidence and not evidence that the package is abandoned.