expo-dev-client

Maintainerscaution

The organization-backed project has 13 registry publishers, but several accounts use outside domains, including ide (jameside.com), bycedric (bycedric.com), tsapeta (tsapeta.com), and philpl (kitten.sh), creating account-hygiene caution.

Repo package mentioncaution

The linked repository is the Expo monorepo, so the name mismatch is ordinary, but it neither matches the package name nor mentions expo-dev-client in its README; ownership of the package is therefore less explicit.

Workflow auditcaution

All 136 analyzed action references are pinned, and no untrusted checkouts or script-injection findings were reported. However, only 30 of 54 workflows were analyzed, and high-confidence template-injection findings remain hygiene concerns.