@expo/image-utils

Build provenancecaution

No build attestation or trusted-publisher identity is available, which limits release transparency, but this is not by itself evidence of an unhealthy project.

Maintainerscaution

The package has 13 publishing accounts, but several use consumer or outside domains, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, wschurman, ide, bycedric, tsapeta, philpl; this is a minor account-hygiene concern mitigated by the Expo organization and active repository contributors.

Workflow auditcaution

All 136 analyzed action references are pinned and no untrusted checkouts or script-injection findings were reported. However, only 30 of 54 workflows were analyzed, and high-confidence template-injection findings remain hygiene concerns, though their paths do not overlap the two pull_request_target workflows.