expo-router

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, reducing publication transparency, although the active organization-backed project provides compensating maintenance evidence.

Licensecaution

The manifest declares MIT, while the artifact license file is recognized as Apache-2.0, creating a licensing mismatch despite license files being present in both artifact and repository.

Maintainerscaution

The package has organization backing through Expo, but several publish accounts use consumer or outside domains, including brentvatne, exponent, kudochien, alanhughes, ccheever, szdziedzic, wschurman, ide, bycedric, tsapeta, philpl. This is an account-hygiene caution, partially offset by the organization-owned project.

Repo package mentioncaution

The repository name does not match expo-router and its README does not mention the package. Although a monorepo name mismatch is ordinary, the lack of a README mention leaves some uncertainty that this repository is the package's source.

Workflow auditcaution

The audit covered 30 of 54 workflows, so coverage is incomplete. It found high-confidence template-injection findings and top-level write permissions, but no untrusted checkouts or script injection, and the reported trigger paths do not overlap the template-injection paths; this warrants workflow hygiene caution rather than a severe dependency risk.