expo-network

Maintainerscaution

The package has 13 registry publishers and clear expo.io affiliation, but several publish accounts use consumer or outside domains, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, wschurman, ide, bycedric, tsapeta, philpl; this is an account-hygiene concern rather than evidence of limited maintenance capacity.

Workflow auditcaution

All 136 analyzed action references are pinned and no untrusted checkout or script-injection sink was found, but only 30 of 54 workflows were analyzed and high-confidence template-injection findings remain across several workflows; the findings are hygiene concerns because they do not overlap with the reported pull_request_target workflows.