The Expo CLI (with updated dependencies)
No malicious install-time or agent-control attack surface was found. On explicit CLI use, enabled telemetry can send command telemetry plus detected agent/sandbox context to Expo's telemetry endpoint.
Package source references dynamic require/import behavior.
internal/unstable-expo-updates-exports.jsView on unpkg · L2Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
build/src/utils/errors.jsView on unpkg · L41Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
build/src/start/platforms/android/adbReverse.jsView on unpkg · L66A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
build/src/start/server/metro/createTypescriptResolver.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
build/src/utils/npm.jsView on unpkgThis report applies to @depup/expo__cli@57.0.15-depup.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package source references dynamic require/import behavior.
internal/unstable-expo-updates-exports.jsView on unpkg · L2A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
build/src/start/server/metro/createTypescriptResolver.jsView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
build/src/utils/npm.jsView on unpkgSource gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
build/src/utils/errors.jsView on unpkg · L41Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
build/src/start/platforms/android/adbReverse.jsView on unpkg · L66