expo-dev-menu-interface

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent; this is a supply-chain transparency gap rather than evidence of an unhealthy project.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, creating uncertainty about package-to-repository linkage; the mismatch is partly explained by the organization’s monorepo structure but remains a transparency gap.

Workflow auditcaution

The audit analyzed 30 of 53 workflows and found high-confidence template-injection findings plus high-confidence adhoc package installs; top-level write permissions affect six workflows. No untrusted checkouts or script injections were found, but incomplete coverage and these hygiene issues warrant caution.