expo-localization

Build provenancecaution

No build attestation or trusted publisher identity is provided. This is a transparency gap for verifying how the release was produced, though it is not evidence that the release is unsafe by itself.

Repo package mentioncaution

The repository name does not match expo-localization and its README does not mention the package. Because this is a monorepo, the name mismatch is ordinary, but the lack of a README mention leaves a modest package-to-repository transparency gap.

Token permissionscaution

Twenty-four analyzed workflows lack top-level permissions declarations, and six declare top-level write access; none declare read-only permissions. This is a repository workflow-hygiene concern, although it is partly mitigated by the absence of detected untrusted checkouts or script injection.