@expo/fingerprint

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This reduces publication transparency, but the active release history and maintained organization repository provide compensating evidence.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention the package. This is a transparency concern because the package's exact repository relationship is not evident, although the organization backing and monorepo structure provide partial context.

Token permissionscaution

Twenty-four analyzed workflows lack top-level permissions and six declare top-level write access, with no workflows declaring read-only permissions. This is a genuine workflow-hygiene concern, though no dangerous checkout or script-injection behavior was observed.

Version stabilitycaution

The assessed release is not a prerelease, although it is below a stable major version and 40% of recent releases are prereleases. This is a manageable maturity caveat rather than a significant adoption risk.