Loading npm security reports…
The Expo CLI (with updated dependencies)
No install-time execution or unconsented control-surface mutation was found. User-invoked CLI telemetry includes agent/sandbox identifiers and posts to an Expo-owned endpoint; MCP behavior is explicitly gated.
Package source references dynamic require/import behavior.
internal/unstable-expo-updates-exports.jsView on unpkg · L2Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
build/src/utils/errors.jsView on unpkg · L41Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
build/src/start/platforms/android/adbReverse.jsView on unpkg · L66A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
build/src/start/server/metro/createTypescriptResolver.jsView on unpkgMCP tunnel setup is gated by EXPO_UNSTABLE_MCP_SERVER and requires project-installed expo-mcp.
build/src/start/server/MCP.jsView on unpkg · L42This report applies to @depup/expo__cli@57.0.17-depup.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package source references dynamic require/import behavior.
internal/unstable-expo-updates-exports.jsView on unpkg · L2A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
build/src/start/server/metro/createTypescriptResolver.jsView on unpkgSource gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
build/src/utils/errors.jsView on unpkg · L41Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
build/src/start/platforms/android/adbReverse.jsView on unpkg · L66MCP tunnel setup is gated by EXPO_UNSTABLE_MCP_SERVER and requires project-installed expo-mcp.
build/src/start/server/MCP.jsView on unpkg · L42