@expo/cli@57.0.13: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@expo/cli@57.0.13: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

5 flagged · loading source

internal/unstable-expo-updates-exports.jsView file

2// NOTE for Expo Maintainers: Do not add to this file. We want to remove this L3: module.exports = require('../build/src/expoUpdatesExports');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

internal/unstable-expo-updates-exports.jsView on unpkg · L2

build/src/utils/errors.jsView file

41} L42: function _child_process() { L43: const data = require("child_process"); ... L107: * L108: * @see https://github.com/expo/expo/issues/29083 L109: * @see https://github.com/facebook/metro/issues/834 ... L112: // Only enable special logging when running on macOS and are running into the `EMFILE` error L113: if ('code' in error && error.code === 'EMFILE' && process.platform === 'darwin') { L114: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

build/src/utils/errors.jsView on unpkg · L41

build/src/start/platforms/android/adbReverse.jsView file

66package = @expo/cli; repositoryIdentity = expo; dependency = debug L66: } L67: const debug = require('debug')('expo:start:platforms:android:adbReverse'); L68: let removeExitHook = null;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

build/src/start/platforms/android/adbReverse.jsView on unpkg · L66

build/src/start/server/metro/createTypescriptResolver.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/src/start/server/metro/createTypescriptResolver.jsView on unpkg

build/src/run/ios/XcodeBuild.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @expo/cli@57.0.3 matchedIdentity = npm:QGV4cG8vY2xp:57.0.3 similarity = 0.808 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/src/run/ios/XcodeBuild.jsView on unpkg

Source & flagged code

5 flagged

internal/unstable-expo-updates-exports.jsView file

2// NOTE for Expo Maintainers: Do not add to this file. We want to remove this L3: module.exports = require('../build/src/expoUpdatesExports');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

internal/unstable-expo-updates-exports.jsView on unpkg · L2

build/src/utils/errors.jsView file

41} L42: function _child_process() { L43: const data = require("child_process"); ... L107: * L108: * @see https://github.com/expo/expo/issues/29083 L109: * @see https://github.com/facebook/metro/issues/834 ... L112: // Only enable special logging when running on macOS and are running into the `EMFILE` error L113: if ('code' in error && error.code === 'EMFILE' && process.platform === 'darwin') { L114: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

build/src/utils/errors.jsView on unpkg · L41

build/src/start/platforms/android/adbReverse.jsView file

66package = @expo/cli; repositoryIdentity = expo; dependency = debug L66: } L67: const debug = require('debug')('expo:start:platforms:android:adbReverse'); L68: let removeExitHook = null;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

build/src/start/platforms/android/adbReverse.jsView on unpkg · L66

build/src/start/server/metro/createTypescriptResolver.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/src/start/server/metro/createTypescriptResolver.jsView on unpkg

build/src/run/ios/XcodeBuild.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @expo/cli@57.0.3 matchedIdentity = npm:QGV4cG8vY2xp:57.0.3 similarity = 0.808 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/src/run/ios/XcodeBuild.jsView on unpkg