expo-dev-launcher

Build provenancecaution

The package has no registry attestation or trusted-publisher identity, leaving published-build provenance less transparent despite the repository's active development.

Maintainerscaution

The package has 13 publishing accounts and is backed by an organization, but several accounts use consumer or outside domains, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, wschurman, ide, bycedric, tsapeta, philpl, and their listed domains. This is an account-hygiene concern rather than evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match expo-dev-launcher and its README does not mention the package, creating an ownership-transparency caution. The package tree and Expo organization backing partly explain this as a monorepo sub-package.

Workflow auditcaution

The audit covered only 30 of 54 workflows and found six high-confidence template-injection findings, plus lower-confidence cache-poisoning and high-confidence ad hoc package installs. No untrusted checkout or script-injection sink was reported, so this is a workflow-hygiene caution rather than a standalone severe risk.