expo

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package's strong maintenance evidence.

Maintainerscaution

The organization-backed project has 13 registry publishers, but several accounts use consumer or outside domains, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, wschurman, ide, bycedric, tsapeta, and philpl. This is account hygiene caution, partly offset by the expo.io organization backing.

Workflow auditcaution

The audit covered only 30 of 54 workflows, so it is incomplete. It found high-confidence template-injection patterns in several workflows; template injection alone is a hygiene concern, while the two pull_request_target workflows had no untrusted checkout or script-injection counts.