@expo/xcpretty

Maintainerscaution

The package is backed by an organization, but publish access includes outside-domain accounts such as ide (jameside.com), bycedric (bycedric.com), tsapeta (tsapeta.com), and philpl (kitten.sh), creating account-hygiene risk despite the clear expo.io domain.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @expo/xcpretty. This is a caution because the package-to-repository connection is not explicit, although the organization-backed monorepo context partly explains the mismatch.

Workflow auditcaution

The audit covered only 30 of 54 workflows and found 18 high-confidence template-injection findings, plus high-confidence ad hoc package installs; low-confidence cache findings are hygiene only. No untrusted checkout or script-injection sink was found, but incomplete coverage warrants caution.