@expo/eas-json

Maintainerscaution

Several publishing accounts use outside domains, including ide, bycedric, tsapeta, and philpl, which creates account-hygiene caution; the Expo organization and active contributor base partly compensate.

Repo package mentioncaution

The linked eas-cli repository neither matches the package name nor mentions @expo/eas-json in its README, so package ownership is less directly transparent; this may reflect a monorepo subpackage but remains a caution.

Workflow auditcaution

The audit covered all 20 workflows and found no untrusted checkout or script-injection sink, but it identified a high-confidence template-injection issue, secrets inheritance, archived action use, and ad hoc package installs. These are workflow hygiene concerns rather than evidence that this release is unsafe on their own.