Expo Router is a file-based router for React Native and web applications.
86%
Total Score
healthy
Active organization-backed package with strong release and contributor activity, offset by CI audit gaps and publisher-account hygiene concerns.
Several publishing accounts use personal domains, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, wschurman, ide, bycedric, tsapeta, philpl, and wschurman; this is an account-hygiene concern, though the Expo organization provides backing.
The repository name does not match the package and its README does not mention @expo/router-server, creating some uncertainty about package-to-repository ownership despite the matching Expo organization.
All 136 analyzed action references are pinned and there are no untrusted checkouts or script injections. However, only 30 of 54 workflows were analyzed, six workflows grant top-level write access, and high-confidence template-injection findings remain hygiene concerns; the reported template findings do not overlap the two pull_request_target workflows.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
debug Version ^4.3.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.