expo-sharing

Maintainerscaution

The organization-backed project has many publishing accounts, but outside-domain accounts such as ide, bycedric, tsapeta, and philpl create account-hygiene exposure despite the company domain.

Repo package mentioncaution

The repository name does not match expo-sharing and its README does not mention the package, creating some uncertainty about linkage; the Expo monorepo context makes a name mismatch less concerning by itself.

Workflow auditcaution

The audit found high-confidence template-injection findings and high-confidence adhoc package installs, while only 30 of 54 workflows were analyzed; no untrusted checkout or script-injection sink was reported, limiting the severity.