Healthy and suitable to depend on. It has frequent releases, active work from a large contributor base, clear licensing, tests in the repository, and strong organization backing. The linked monorepo does not identify this package directly, and release provenance is not attested.
92%
Total Score
100
100
94
88
50
No build attestation or trusted-publisher identity is available, leaving publication provenance less transparent even though the package otherwise has strong maintenance evidence.
The linked repository neither matches the package name nor mentions expo-crypto in its README, creating some uncertainty about the package-to-repository mapping; the organization-owned Expo monorepo provides partial contextual reassurance but does not remove the transparency gap.
Among the analyzed workflows, 24 lack top-level permissions and 6 grant top-level write access; although no read-only workflow permissions were detected, this is a genuine repository automation-hygiene concern.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.