@expo/steps

Licensecaution

The manifest declares BUSL-1.1 while the artifact and repository license files are detected as MIT, creating a meaningful licensing ambiguity despite the presence of license files.

Maintainerscaution

Several publishing accounts use consumer or outside domains, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, wschurman, ide, bycedric, tsapeta, and philpl; this is account-hygiene caution, though organizational backing reduces maintenance-capacity concern.

Repo package mentioncaution

The repository name does not match @expo/steps and its README does not mention the package, so the linkage is less transparent even though the package appears to be a monorepo subpackage.

Workflow auditcaution

All 20 workflows were analyzed with no untrusted checkout or script-injection findings and all action references pinned. However, the audit reports a high-confidence template-injection finding, medium-confidence secrets inheritance and archived-action findings, plus high-confidence ad hoc package installs; the pull_request_target trigger is not shown to share the reported sink.