@expo/local-build-cache-provider

Maintainerscaution

The package has 13 registry publishers, including Expo-domain accounts and several outside-domain accounts such as ide, bycedric, tsapeta, and philpl. The organization backing compensates for the account-hygiene concern, but those outside identities remain a minor caution.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it. A name mismatch is normal for a monorepo, but the missing README mention leaves a small ownership-transparency gap.

Workflow auditcaution

The audit analyzed 30 of 54 workflows and found high-confidence template-injection findings plus high-confidence adhoc package installs; the low-confidence cache-poisoning findings are hygiene concerns. No untrusted checkout or script-injection sink was reported, so this lowers confidence and warrants caution rather than indicating a release-level danger.