expo
The Expo SDK
88%
Total Score
healthy
Frequent releases, active maintenance, and a broad contributor base make this a strong dependency.
Health Score Breakdown
The package has 13 publish-access accounts and organizational backing, but several accounts use outside domains, including ide, bycedric, tsapeta, and philpl; this is an account-hygiene caution rather than evidence of a thin maintenance team.
All analyzed action references are pinned and no untrusted checkout or script-injection paths were found, but only 30 of 54 workflows were analyzed; high-confidence template-injection findings and six workflows with top-level write permissions remain hygiene concerns.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2023-28131 expo is vulnerable to Insufficiently Protected Credentials in versions 0.0.0 - 48.0.0. | 0.0.0 - 48.0.0 | Critical |
CVE-2020-24653 expo is vulnerable to Security Vulnerability in versions 0.0.0 - 9.1.0. | 0.0.0 - 9.1.0 | Critical |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 @expo/cli Version ^57.0.29 | — | — |
expo-font Version ~57.0.4 | — | — |
expo-asset Version ~57.0.19 | — | — |
@expo/metro Version ~56.0.2 | — | — |
@expo/config Version ~57.0.10 | — | — |
Weekly Downloads
Info
- Last Published
- 1 day ago
- Created
- 13 years ago
- Unpacked Size
- 1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.