@tamagui/native-ci
Native CI/CD helpers for React Native apps with Expo - fingerprinting, caching, and build optimization
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): env-spread is used to pass environment to a child process (Bun.spawn), standard CLI pattern for this CI helper package. | ai | |
| phantom-deps | phantom-dep:@expo/fingerprint | AI (phantom-deps): @expo/fingerprint is a declared runtime dependency; phantom-dep heuristic false positive for this package. | ai |
Versions (showing 26 of 26)
| Version | Deps | Published |
|---|---|---|
| 2.1.0 | 1 / 3 | |
| 2.0.0 | 1 / 3 | |
| 1.144.4 | 1 / 3 | |
| 1.144.3 | 1 / 3 | |
| 1.144.2 | 1 / 3 | |
| 1.144.1 | 1 / 3 | |
| 1.144.0 | 1 / 3 | |
| 1.143.1 | 1 / 3 | |
| 1.143.0 | 1 / 3 | |
| 1.142.0 | 1 / 3 | |
| 1.141.5 | 1 / 3 | |
| 1.141.4 | 1 / 3 | |
| 1.141.3 | 1 / 3 | |
| 1.141.2 | 1 / 3 | |
| 1.141.1 | 1 / 3 | |
| 1.141.0 | 1 / 3 | |
| 1.140.4 | 1 / 3 | |
| 1.140.3 | 1 / 3 | |
| 1.140.2 | 1 / 3 | |
| 1.140.1 | 1 / 3 | |
| 1.140.0 | 1 / 3 | |
| 1.139.4 | 1 / 3 | |
| 1.139.3 | 1 / 3 | |
| 1.139.2 | 1 / 3 | |
| 1.139.1 | 1 / 3 | |
| 1.139.0 | 1 / 3 |
v2.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.144.4
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.144.3
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.144.2
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.144.1
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.144.0
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.143.1
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.143.0
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.142.0
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.141.5
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.141.4
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.141.3
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.141.2
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.141.1
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.141.0
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.140.4
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.140.3
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.140.2
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.140.1
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.140.0
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.139.4
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.139.3
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.139.2
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.139.1
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.139.0
2 findingsSpreading entire process.env into an object — may capture all secrets 105 | // This is important for CI where cache from previous runs might cause issues 106 | const proc = Bun.spawn(['yarn', 'expo', 'start', '--dev-client', '--offline', '--clear'], { > 107 | env: { ...process.env, EXPO_NO_TELEMETRY: 'true' }, 108 | stdout: 'inherit', 109 | stderr: 'inherit',
Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.