expo-secure-store

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less independently verifiable. This is a transparency gap, but the package has substantial repository and release evidence supporting it.

Repo package mentioncaution

The linked repository neither matches the package name nor mentions it in its README, so the package-to-repository relationship is less transparent. The Expo organization context and the package’s Expo-specific file structure partly compensate for this gap.

Token permissionscaution

24 analyzed workflows lack top-level token permissions and 6 declare top-level write access, creating a workflow-hardening gap even though no direct malicious behavior is shown.