registry / @expo/cli / 57.0.21

@expo/cli@57.0.21

The Expo CLI

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No malicious install-time or import-time attack surface was confirmed. Runtime network and device operations are tied to explicit Expo CLI commands.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs an Expo CLI command that uses authentication, package management, telemetry, or Android development features.

Impact

No confirmed credential theft, destructive action, persistence, or agent-control modification.

Mechanism

Command-scoped Expo API, telemetry, npm, and ADB operations.

AI rationale

The flagged primitives are command-scoped CLI functionality, and the package has no registry lifecycle hook. Agent and sandbox detection is limited to telemetry metadata; no source path establishes malicious behavior.

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest has no preinstall, install, postinstall, or prepare hook.
The browser SSO flow uses a random verifier and state, then checks the returned state.
The npm helper invokes npm only when its exported function is called.
The Watchman commands are restricted to macOS EMFILE recovery.
ADB reverse operates only on authorized attached devices.

@expo/cli@57.0.21

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code