expo-image

Build provenancecaution

No build attestation or trusted publisher provenance is available, which leaves publication origin less verifiable even though the package otherwise shows strong maintenance evidence.

Repo package mentioncaution

The repository name does not match expo-image and its README does not mention the package, creating a transparency concern about the package-to-repository link. The mismatch is plausibly consistent with a monorepo, but the provided signal does not confirm the package path.

Token permissionscaution

24 of 30 analyzed workflows lack top-level permissions declarations, and six declare top-level write access; this weakens least-privilege transparency despite the repository's other security controls.