babel-preset-expo

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent than it could be, although this is not evidence that the release is unsafe.

Maintainerscaution

The package is backed by the Expo organization, which compensates for a narrow registry publishing domain; several publish accounts use outside domains, including ide, bycedric, tsapeta, and philpl, creating an account-hygiene caution rather than evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match babel-preset-expo and its README does not mention the package, which creates a provenance ambiguity; the package is nevertheless linked to the Expo organization’s large monorepo.

Workflow auditcaution

The audit analyzed 30 of 54 workflows and found 18 high-confidence template-injection findings plus high-confidence ad hoc package installation findings; the template findings are hygiene concerns, while incomplete coverage prevents a clean bill of health.