@expo/sdk-runtime-versions

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving the artifact's build origin less verifiable. This is a transparency weakness rather than evidence of malicious behavior.

Maintainerscaution

The publisher list includes consumer-domain accounts such as brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, and wschurman using gmail.com, plus outside-domain accounts ide, bycedric, tsapeta, and philpl. This is an account-hygiene concern, although it does not establish a small maintenance team.

Release historycaution

The package has only two releases over about five and a half years, with one release in the last 12 months and a roughly five-and-a-half-year median interval. This suggests sparse maintenance activity, though the recent release shows the package is not wholly abandoned.