expo-linear-gradient

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This limits publication transparency, but it is not by itself evidence of poor maintenance or abandonment.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention this package. This is a transparency gap, although the package file tree and Expo organizational backing make a monorepo subpackage relationship plausible.

Token permissionscaution

Twenty-four analyzed workflows lack top-level permissions declarations and six declare top-level write permissions. This is a workflow hygiene concern, but there are no corresponding untrusted-checkout or script-injection findings in the provided analysis.