No SLSA provenancenpm registry signaturesgitHead linked
Without SLSA provenance there is no cryptographic link between this
tarball and the public source — the axios compromise (March 2026)
relied on exactly this gap.
Findings the reviewer chose to accept rather than block on.
Source
Rule
Reason
Accepted by
When
provenance
publisher-changed
AI (provenance): brentvatne is a core Expo team member; transition from expo-bot (CI publisher) to a named maintainer is a routine organizational change within the same org.
ai
semgrep
semgrep:eval-usage
AI (semgrep): eval('require') is an intentional bundler-escape pattern to prevent static analysis of node:crypto require; input is not user-controlled. Stable pattern in the Expo codebase.