expo-image
A cross-platform, performant image component for React Native and Expo with Web support
9
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
idebrentvatneevanbaconexpoadminexponentbycedrickudochienalanhughestsapetaexpo-botphilplwschurmanaleqsio
Keywords
react-native
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | bundled-binaries | AI (npm-metadata): Prebuilt iOS xcframeworks for image codecs (libavif, SDWebImage); expected for this native module. | ai | |
| provenance | missing-githead | AI (provenance): expo-image canary releases are built from a different CI pipeline that does not inject gitHead; consistent pattern for this package's pre-release builds. | ai | |
| publish-pattern | suspicious-version-number | AI (publish-pattern): Expo uses a well-documented canary versioning pattern (semver-canary-YYYYMMDD-githash); this is a stable false positive for the expo-image package family. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Expo periodically cleans up npm maintainer lists across their monorepo packages; mass removals are a known org practice, not a takeover signal given the publisher's track record. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): New maintainers are consistent with team changes at Expo/650 Industries; no indicators of hostile takeover. | ai | |
| provenance | publisher-changed | AI (provenance): alanhughes is a long-standing Expo team member (811 days, 282 approved/0 rejected). Publisher rotations are normal within the Expo org and do not indicate compromise. | ai | |
| dependencies | unvetted-dep:sf-symbols-typescript | AI (dependencies): sf-symbols-typescript is a legitimate TypeScript types package for Apple SF Symbols, expected in an Expo/React Native image component with iOS support. | ai | |
| provenance | no-provenance | AI (provenance): expo-image is published from the Expo monorepo; lack of Sigstore provenance is expected and consistent across all Expo SDK packages. | ai |