registry / @depup/expo__cli / 57.0.13-depup.0

@depup/expo__cli@57.0.13-depup.0

The Expo CLI (with updated dependencies)

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 400 file(s), 1.97 MB of source, external domains: 127.0.0.1, api.expo.dev, api.github.com, apps.apple.com, cdp.expo.dev, codeload.github.com, developer.android.com, developer.apple.com, docs.expo.dev, expo.dev, expo.fyi, expo.test, facebook.github.io, github.com, itunes.apple.com, nodejs.org, play.google.com, reactnative.directory, registry.npmjs.org, schemas.android.com, staging-api.expo.dev, staging.expo.dev, status.expo.dev, status.ngrok.com

Source & flagged code

4 flagged

internal/unstable-expo-updates-exports.jsView file

Lines 1-4javascript

1// WARN: Internal re-export, don't rely on this to be a public API or use it outside of `expo/expo`'s monorepo

2// NOTE for Expo Maintainers: Do not add to this file. We want to remove this

3module.exports = require('../build/src/expoUpdatesExports');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

internal/unstable-expo-updates-exports.jsView on unpkg · L2

build/src/utils/errors.jsView file

Lines 21-61javascript

21 get UnimplementedError () {

22 return UnimplementedError;

23 },

24 get logCmdError () {

25 return logCmdError;

26 }

27});

28function

build/src/start/platforms/android/adbReverse.jsView file

Lines 46-86javascript

46 }

47 var newObj = {

48 __proto__: null

49 };

50 var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor;

51 for(

build/src/start/server/metro/createTypescriptResolver.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/src/start/server/metro/createTypescriptResolver.jsView on unpkg

Source & flagged code

4 flagged · loading source

@depup/expo__cli@57.0.13-depup.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code