expo-splash-screen

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent even though the package has strong independent maintenance evidence.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention the package, so the package-to-repository relationship is less directly transparent; the Expo monorepo context and package file structure partly compensate.

Token permissionscaution

24 analyzed workflows lack top-level permissions and 6 grant top-level write access, creating workflow-hardening concerns; no analyzed workflow declares read-only permissions, so least-privilege transparency is incomplete.