expo-image
A cross-platform, performant image component for React Native and Expo with Web support
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | bundled-binaries | AI (npm-metadata): Prebuilt iOS xcframeworks for image codecs (libavif, SDWebImage); expected for this native module. | ai | |
| provenance | missing-githead | AI (provenance): expo-image canary releases are built from a different CI pipeline that does not inject gitHead; consistent pattern for this package's pre-release builds. | ai | |
| publish-pattern | suspicious-version-number | AI (publish-pattern): Expo uses a well-documented canary versioning pattern (semver-canary-YYYYMMDD-githash); this is a stable false positive for the expo-image package family. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Expo periodically cleans up npm maintainer lists across their monorepo packages; mass removals are a known org practice, not a takeover signal given the publisher's track record. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are consistent with team changes at Expo/650 Industries; no indicators of hostile takeover. | ai | |
| provenance | publisher-changed | AI (provenance): alanhughes is a long-standing Expo team member (811 days, 282 approved/0 rejected). Publisher rotations are normal within the Expo org and do not indicate compromise. | ai | |
| dependencies | unvetted-dep:sf-symbols-typescript | AI (dependencies): sf-symbols-typescript is a legitimate TypeScript types package for Apple SF Symbols, expected in an Expo/React Native image component with iOS support. | ai | |
| provenance | no-provenance | AI (provenance): expo-image is published from the Expo monorepo; lack of Sigstore provenance is expected and consistent across all Expo SDK packages. | ai |
Versions (showing 51 of 109)
| Version | Deps | Published |
|---|---|---|
| 56.0.8 | 1 / 4 | |
| 56.0.6 | 1 / 4 | |
| 56.0.5 | 1 / 4 | |
| 56.0.4 | 1 / 4 | |
| 56.0.3 | 1 / 4 | |
| 56.0.2 | 1 / 4 | |
| 56.0.1 | 1 / 3 | |
| 56.0.0 | 1 / 3 | |
| 55.0.10 | 1 / 1 | |
| 55.0.9 | 1 / 1 | |
| 55.0.8 | 1 / 1 | |
| 55.0.7 | 1 / 1 | |
| 55.0.6 | 1 / 1 | |
| 55.0.5 | 1 / 1 | |
| 55.0.4 | 1 / 1 | |
| 55.0.3 | 1 / 1 | |
| 55.0.2 | 1 / 1 | |
| 55.0.1 | 1 / 1 | |
| 55.0.0 | 1 / 1 | |
| 3.0.11 | 0 / 1 | |
| 3.0.10 | 0 / 1 | |
| 3.0.9 | 0 / 1 | |
| 3.0.8 | 0 / 1 | |
| 3.0.7 | 0 / 1 | |
| 3.0.6 | 0 / 1 | |
| 3.0.5 | 0 / 1 | |
| 3.0.4 | 0 / 1 | |
| 3.0.3 | 0 / 1 | |
| 3.0.2 | 0 / 1 | |
| 3.0.1 | 0 / 1 | |
| 3.0.0 | 0 / 1 | |
| 2.4.1 | 0 / 1 | |
| 2.4.0 | 0 / 1 | |
| 2.3.2 | 0 / 1 | |
| 2.3.1 | 0 / 1 | |
| 2.3.0 | 0 / 1 | |
| 2.2.1 | 0 / 1 | |
| 2.2.0 | 0 / 1 | |
| 2.1.7 | 0 / 1 | |
| 2.1.6 | 0 / 1 | |
| 2.1.5 | 0 / 1 | |
| 2.1.4 | 0 / 1 | |
| 2.1.3 | 0 / 1 | |
| 2.1.2 | 0 / 1 | |
| 2.1.1 | 0 / 1 | |
| 2.1.0 | 0 / 1 | |
| 2.0.7 | 0 / 1 | |
| 2.0.6 | 0 / 1 | |
| 2.0.5 | 0 / 1 | |
| 2.0.4 | 0 / 1 | |
| 2.0.3 | 0 / 1 |
v56.0.8
3 findingsPackage contains compiled binaries that could be backdoors: • prebuilds/spm-deps/libavif/debug/libavif.xcframework/ios-arm64/libavif.framework/libavif • prebuilds/spm-deps/libavif/release/libavif.xcframework/ios-arm64/dSYMs/libavif.framework.dSYM/Contents/Resources/DWARF/libavif • prebuilds/spm-deps/libavif/release/libavif.xcframework/ios-arm64/libavif.framework/libavif • prebuilds/spm-deps/SDWebImage/debug/SDWebImage.xcframework/ios-arm64/SDWebImage.framework/SDWebImage • prebuilds/spm-deps/SDWebImage/release/SDWebImage.xcframework/ios-arm64/dSYMs/SDWebImage.framework.dSYM/Contents/Resources/DWARF/SDWebImage • prebuilds/spm-deps/SDWebImage/release/SDWebImage.xcframework/ios-arm64/SDWebImage.framework/SDWebImage • prebuilds/spm-deps/SDWebImageAVIFCoder/debug/SDWebImageAVIFCoder.xcframework/ios-arm64/SDWebImageAVIFCoder.framework/SDWebImageAVIFCoder • prebuilds/spm-deps/SDWebImageAVIFCoder/release/SDWebImageAVIFCoder.xcframework/ios-arm64/dSYMs/SDWebImageAVIFCoder.framework.dSYM/Contents/Resources/DWARF/SDWebImageAVIFCoder • prebuilds/spm-deps/SDWebImageAVIFCoder/release/SDWebImageAVIFCoder.xcframework/ios-arm64/SDWebImageAVIFCoder.framework/SDWebImageAVIFCoder • prebuilds/spm-deps/SDWebImageSVGCoder/debug/SDWebImageSVGCoder.xcframework/ios-arm64/SDWebImageSVGCoder.framework/SDWebImageSVGCoder ... and 5 more
[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version was published by a different npm account than previous versions on 2026-05-21. This could indicate a legitimate maintainer transition or an account compromise.
v56.0.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v56.0.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v55.0.10
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.