@expo/inline-modules

Maintainerscaution

The package has 13 registry publishers and is backed by the Expo organization. Several publishers use outside or personal domains, including ide (jameside.com), bycedric (bycedric.com), tsapeta (tsapeta.com), philpl (kitten.sh), and seven gmail.com accounts; this is account-hygiene caution, not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @expo/inline-modules. A monorepo name mismatch is normal, but the missing package mention leaves some uncertainty that this repository is the package's intended source.

Version stabilitycaution

The release is not a prerelease, although the package remains below a stable major version and 30% of recent releases are prereleases. This is a modest maturity consideration, not a major dependency risk.

Workflow auditcaution

The audit covered only 30 of 54 workflows, so repository workflow coverage is incomplete. It found high-confidence template-injection patterns and high-confidence ad hoc package installs; the pull_request_target workflows had no reported untrusted checkouts or script injection, so these findings warrant caution rather than a severe conclusion.