@expo/prebuild-config

Maintainerscaution

The Expo organization provides backing, but several publishing accounts use personal or outside domains, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, wschurman, ide, bycedric, tsapeta, philpl, and their listed domains; this is an account-hygiene caution rather than evidence of a thin maintenance team.

Repo package mentioncaution

The repository name does not match @expo/prebuild-config and its README does not mention the package, creating a provenance-transparency caution; the package file tree nevertheless shows a substantial built package consistent with a monorepo subpackage.

Workflow auditcaution

All 136 analyzed action references are pinned, and no untrusted checkout or script-injection sink was found. However, only 30 of 54 workflows were analyzed, with high-confidence template-injection findings and several ad hoc package installs; the listed pull_request_target workflows do not establish a trigger-and-sink combination from the supplied paths.