babel-preset-expo

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the artifact’s build origin less independently verifiable despite the package’s otherwise strong project evidence.

Maintainerscaution

The package has 13 registry publishers, but several use consumer or outside domains, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, wschurman, ide, bycedric, tsapeta, philpl; this is an account-hygiene caution, partly offset by Expo organizational backing.

Repo package mentioncaution

The linked Expo monorepo neither matches the package name nor mentions babel-preset-expo in its README. This is plausible for a monorepo subpackage, but the collected evidence leaves package ownership less explicit.

Workflow auditcaution

The audit found no untrusted checkouts or script injection and all 136 action references are pinned, but only 30 of 54 workflows were analyzed. High-confidence template-injection findings and high-confidence ad-hoc package installs remain CI hygiene concerns; the template findings were not shown in the pull_request_target workflows.