expo-server

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This is a transparency gap, though the package's strong maintenance and repository evidence provide meaningful compensating context.

Repo package mentioncaution

The linked repository name does not match expo-server and its README does not mention the package. A monorepo mismatch is ordinary, but the absence of both signals leaves some uncertainty about package-to-repository correspondence.

Workflow auditcaution

The audit analyzed 30 of 53 workflows, so coverage is incomplete. It found no untrusted checkouts or script injections and all 137 action references were pinned, but the incomplete review and high-confidence template-injection findings warrant caution even though their trigger linkage is not established here.