@expo/metro-config

A Metro config for running React Native projects with the Metro bundler

Latest 57.0.13

84%

Total Score

healthy

Frequent releases, broad active contribution, and organizational backing outweigh workflow and package-to-repository hygiene concerns.

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent. This is a supply-chain transparency gap, but it is not evidence that the release is unsafe.

Maintainers

The package has organizational backing through Expo, but seven consumer-domain accounts and four outside-domain accounts publish from addresses not controlled by expo.io, including ide, bycedric, tsapeta, and philpl. This is an account-hygiene caution, not evidence of a thin maintenance team.

Repo package mention

The linked repository is the Expo monorepo, so its name not matching the package is ordinary. However, the README does not mention @expo/metro-config, leaving package-to-repository linkage less explicit than ideal.

Workflow audit

All 136 analyzed action references are pinned, and the two pull_request_target workflows have no reported untrusted checkout or script-injection sinks. However, only 30 of 54 workflows were analyzed, six workflows grant top-level write permissions, and high-confidence template-injection findings remain in several workflows; the audit is therefore incomplete and warrants caution.