@expo/metro-runtime

Tools for making advanced Metro bundler features work

Latest 57.0.17

84%

Total Score

healthy

Active releases and a large, diverse contributor base make this a well-supported release; workflow review is incomplete.

Health Score Breakdown

Maintainers

The registry lists 13 publishing accounts, with several outside the expo.io domain, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, wschurman, ide, bycedric, tsapeta, philpl, and their listed domains. This is a mild account-hygiene caution, partly offset by organizational backing and active repository contributors.

Repo package mention

The repository name differs from the package name and its README does not mention @expo/metro-runtime. A monorepo name mismatch is ordinary, but the missing README mention creates a modest ownership and traceability concern.

Workflow audit

All 136 analyzed action references are pinned, and no untrusted checkouts or script-injection findings were reported. However, only 30 of 54 workflows were analyzed, and high-confidence template-injection findings plus several ad hoc package installs leave workflow hygiene unresolved.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Direct Dependencies

Dependency	Last Release	Score
anser Version ^1.4.9	—	—
whatwg-fetch Version ^3.0.0	—	—
@expo/log-box Version ^57.0.4	—	—
pretty-format Version ^29.7.0	—	—
stacktrace-parser Version ^0.1.10	—	—