@expo/eas-build-job

`@expo/eas-build-job` contains types and Joi schemas for job objects. It's used in `eas-cli` to create the job object and on EAS Build workers (and in `eas-cli-local-build-plugin`) to process the job and run the build.

Latest 25.0.0

NPM

88%

Total Score

healthy

Frequent releases and active organization-backed development outweigh workflow audit and publisher-account hygiene concerns.

Health Score Breakdown

Maintainers

The registry has 13 publishers, but several publish through consumer Gmail accounts, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, and wschurman; this is an account-hygiene caution despite the active organization-backed project.

Repo package mention

The repository name does not match the package name and the signal reports no package-name mention in the README, which creates some ownership ambiguity; the package is nevertheless documented as a subpackage in the provided repository README context.

Workflow audit

All 20 workflows were analyzed with no unpinned actions, but the audit reports a high-confidence template-injection finding, archived action use, inherited secrets, and ad hoc package installs. The template-injection finding is not corroborated by an untrusted checkout or script-injection path, so these are workflow hygiene concerns rather than a standalone severe risk.