registry / @expo/cli / 57.0.3

@expo/cli@57.0.3

The Expo CLI

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 397 file(s), 1.95 MB of source, external domains: 127.0.0.1, api.expo.dev, api.github.com, apps.apple.com, cdp.expo.dev, codeload.github.com, developer.android.com, developer.apple.com, docs.expo.dev, expo.dev, expo.fyi, expo.test, facebook.github.io, github.com, itunes.apple.com, nodejs.org, play.google.com, reactnative.directory, registry.npmjs.org, schemas.android.com, staging-api.expo.dev, staging.expo.dev, status.expo.dev, status.ngrok.com

Source & flagged code

3 flagged

add-module.jsView file

1const path = require('node:path'); L2: const { pathToFileURL } = require('node:url');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

add-module.jsView on unpkg · L1

build/src/utils/errors.jsView file

41} L42: function _child_process() { L43: const data = require("child_process"); ... L107: * L108: * @see https://github.com/expo/expo/issues/29083 L109: * @see https://github.com/facebook/metro/issues/834 ... L112: // Only enable special logging when running on macOS and are running into the `EMFILE` error L113: if ('code' in error && error.code === 'EMFILE' && process.platform === 'darwin') { L114: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

build/src/utils/errors.jsView on unpkg · L41

build/src/start/platforms/android/adbReverse.jsView file

66package = @expo/cli; repositoryIdentity = expo; dependency = debug L66: } L67: const debug = require('debug')('expo:start:platforms:android:adbReverse'); L68: let removeExitHook = null;

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

build/src/start/platforms/android/adbReverse.jsView on unpkg · L66

Source & flagged code

3 flagged · loading source

@expo/cli@57.0.3

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code