expo-crypto

Maintainerscaution

The package has 13 registry publishers and clear expo.io ownership, but several publishers use outside domains, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, wschurman, ide, bycedric, tsapeta, philpl, creating some account-continuity risk despite organizational backing.

Repo package mentioncaution

The linked repository is the Expo monorepo, so its name not matching expo-crypto is ordinary; however, the README does not mention expo-crypto, leaving some uncertainty about the exact package-to-repository linkage.

Workflow auditcaution

All 136 analyzed action references are pinned and no untrusted checkouts or script injections were found. However, only 30 of 54 workflows were analyzed, and high-confidence template-injection findings plus high-confidence ad hoc package installs indicate workflow hygiene concerns, though no trigger-and-sink combination was shown.