Loading npm security reports…
The Expo CLI (with updated dependencies)
No confirmed malicious attack surface was established. User-invoked CLI telemetry can send command and runtime context to Expo and can be disabled with EXPO_NO_TELEMETRY.
Package source references dynamic require/import behavior.
internal/unstable-expo-updates-exports.jsView on unpkg · L2Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
build/src/utils/errors.jsView on unpkg · L41Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
build/src/start/platforms/android/adbReverse.jsView on unpkg · L66A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
build/src/api/user/expoSsoLauncher.js#virtual:normalized:round1View on unpkgThe manifest exposes a CLI and lists only build, test, lint, and module scripts; it has no install lifecycle hook.
package.jsonView on unpkg · L175This report applies to @depup/expo__cli@57.0.22-depup.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package source references dynamic require/import behavior.
internal/unstable-expo-updates-exports.jsView on unpkg · L2A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
build/src/api/user/expoSsoLauncher.js#virtual:normalized:round1View on unpkgSource gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
build/src/utils/errors.jsView on unpkg · L41Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
build/src/start/platforms/android/adbReverse.jsView on unpkg · L66The manifest exposes a CLI and lists only build, test, lint, and module scripts; it has no install lifecycle hook.
package.jsonView on unpkg · L175