expo-constants
Provides system information that remains constant throughout the lifetime of your app.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Expo canary releases embed the commit hash in the version string itself; missing gitHead field is a known artifact of their canary publish pipeline, not a security signal. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Empty description is expected in the initial stub release of this well-established Expo package; not a malicious signal. | ai | |
| bogus-package | bogus-package | AI (bogus-package): v0.0.1 is a known namespace-reservation stub for the legitimate Expo ecosystem package; stub characteristics do not generalize as malicious for this publisher. | ai | |
| publish-pattern | suspicious-version-number | AI (publish-pattern): Expo canary releases consistently use this date+commit-hash version format (e.g. X.Y.Z-canary-YYYYMMDD-XXXXXXX); this is a stable false positive for the expo-constants package family. | ai | |
| dependencies | unvetted-dep:ua-parser-js | AI (dependencies): ua-parser-js is a legitimate, widely-used UA parsing library. The ^0.7.19 constraint resolves to safe 0.7.x releases; the historical compromise (0.7.29/1.0.0) was quickly remediated and those versions yanked. | ai | |
| phantom-deps | phantom-dep:expo-constants-interface | AI (phantom-deps): expo-constants-interface is a companion interface package in Expo's modular architecture; not directly imported by design. Stable pattern for this package. | ai | |
| license | uncommon-license:BSD | AI (license): BSD license is used intentionally by 650 Industries/Expo across their package ecosystem; stable and legitimate for this package. | ai | |
| provenance | publisher-changed | AI (provenance): alanhughes is a known Expo team member with a strong track record (116 approved, 0 rejected). Publisher transition from brentvatne to alanhughes is consistent with legitimate Expo org maintainer rotation. | ai | |
| dependencies | unvetted-peer-dep:react-native | AI (dependencies): react-native is the canonical peer dependency for all Expo SDK packages; wildcard constraint is standard and expected for this package. | ai | |
| dependencies | unvetted-peer-dep:expo | AI (dependencies): expo is the canonical peer dependency for all Expo SDK packages; wildcard constraint is standard and expected for this package. | ai | |
| dependencies | unvetted-dep:@expo/config | AI (dependencies): @expo/config is a first-party Expo package from the same monorepo (expo/expo); it is a stable, expected dependency for expo-constants across all versions. | ai | |
| dependencies | unvetted-dep:@expo/env | AI (dependencies): @expo/env is a first-party Expo package from the same monorepo (expo/expo); it is a stable, expected dependency for expo-constants across all versions. | ai | |
| provenance | no-provenance | AI (provenance): expo-constants is a well-established Expo SDK package published from the official expo/expo monorepo; lack of Sigstore provenance is not a meaningful risk signal here. | ai |
Versions (showing 51 of 143)
| Version | Deps | Published |
|---|---|---|
| 56.0.16 | 1 / 5 | |
| 56.0.15 | 1 / 5 | |
| 56.0.14 | 1 / 5 | |
| 56.0.13 | 1 / 5 | |
| 56.0.12 | 1 / 5 | |
| 56.0.11 | 1 / 5 | |
| 56.0.10 | 1 / 5 | |
| 56.0.9 | 1 / 5 | |
| 56.0.8 | 1 / 5 | |
| 56.0.7 | 1 / 5 | |
| 56.0.6 | 1 / 5 | |
| 56.0.5 | 1 / 5 | |
| 56.0.4 | 1 / 5 | |
| 56.0.3 | 1 / 5 | |
| 56.0.2 | 1 / 5 | |
| 56.0.1 | 1 / 4 | |
| 56.0.0 | 1 / 4 | |
| 55.0.16 | 1 / 1 | |
| 55.0.15 | 1 / 1 | |
| 55.0.14 | 2 / 1 | |
| 55.0.13 | 2 / 1 | |
| 55.0.12 | 2 / 1 | |
| 55.0.11 | 2 / 1 | |
| 55.0.10 | 2 / 1 | |
| 55.0.9 | 2 / 1 | |
| 55.0.8 | 2 / 1 | |
| 55.0.7 | 2 / 1 | |
| 55.0.6 | 2 / 1 | |
| 55.0.5 | 2 / 1 | |
| 55.0.4 | 2 / 1 | |
| 55.0.3 | 2 / 1 | |
| 55.0.2 | 2 / 1 | |
| 55.0.1 | 2 / 1 | |
| 55.0.0 | 2 / 1 | |
| 18.0.13 | 2 / 1 | |
| 18.0.12 | 2 / 1 | |
| 18.0.11 | 2 / 1 | |
| 18.0.10 | 2 / 1 | |
| 18.0.9 | 2 / 1 | |
| 18.0.8 | 2 / 1 | |
| 18.0.7 | 2 / 1 | |
| 18.0.6 | 2 / 1 | |
| 18.0.5 | 2 / 1 | |
| 18.0.4 | 2 / 1 | |
| 18.0.3 | 2 / 1 | |
| 18.0.2 | 2 / 1 | |
| 18.0.1 | 2 / 1 | |
| 18.0.0 | 2 / 1 | |
| 17.1.8 | 2 / 1 | |
| 17.1.7 | 2 / 1 | |
| 17.1.6 | 2 / 1 |
v56.0.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.15
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (alanhughes) than the most recent previously approved version (brentvatne) on 2026-05-23, but alanhughes is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v56.0.14
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-05-21. This could indicate a legitimate maintainer transition or an account compromise.
v56.0.13
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.12
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.11
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-05-15. This could indicate a legitimate maintainer transition or an account compromise.
v56.0.10
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-05-14. This could indicate a legitimate maintainer transition or an account compromise.
v56.0.9
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.8
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.7
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.16
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.