← Home

expo-camera

npm Repository Homepage

A React component that renders a preview for the device's either front or back camera. Camera's parameters like zoom, auto focus, white balance and flash mode are adjustable. With expo-camera, one can also take photos and record videos that are saved to t

97
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

idebrentvatneexpoadminexponentbycedrickudochienalanhughestsapetaexpo-botphilplwschurmanccheeverjesseruderterriblebensjchmielaesamelson

Keywords

react-nativeexpocamera

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
npm-metadata bundled-binaries AI (npm-metadata): Prebuilt ZXingObjC xcframework binaries for iOS barcode scanning; expected for this native camera package. ai
provenance missing-githead AI (provenance): expo-camera canary builds are published from a different pipeline than stable releases; missing gitHead is expected for this package's canary workflow. ai
provenance no-provenance AI (provenance): Canary pre-release builds from the Expo monorepo do not go through the same provenance-attesting CI as stable releases; acceptable given publisher track record. ai
publish-pattern suspicious-version-number AI (publish-pattern): Expo canary releases consistently use date-stamped version strings (e.g., 55.0.x-canary-YYYYMMDD-hash); this pattern is standard for the expo ecosystem and not indicative of malice. ai
phantom-deps phantom-dep:expo-permissions-interface AI (phantom-deps): Interface package is part of Expo's modular architecture; declared and used indirectly through config. ai
phantom-deps phantom-dep:expo-camera-interface AI (phantom-deps): Interface package is part of Expo's modular architecture; declared and used indirectly through config. ai
phantom-deps phantom-dep:expo-file-system-interface AI (phantom-deps): Interface package is part of Expo's modular architecture; declared and used indirectly through config. ai
phantom-deps phantom-dep:expo-face-detector-interface AI (phantom-deps): Interface package is part of Expo's modular architecture; declared and used indirectly through config. ai
maintainer-change maintainer-added AI (maintainer-change): New maintainer philpl is associated with the Expo organization; this is a legitimate team addition for a major Expo SDK package. ai
maintainer-change maintainer-removed AI (maintainer-change): Maintainer roster changes are routine for a large org like 650 Industries/Expo; no evidence of hostile takeover. ai
provenance publisher-changed AI (provenance): brentvatne is a well-known Expo core team member publishing from the official expo/expo monorepo; publisher changes within the Expo org are routine and expected. ai
dependencies unvetted-peer-dep:react-native AI (dependencies): react-native is the expected peer dependency for React Native libraries; stable for this package. ai
dependencies unvetted-peer-dep:expo AI (dependencies): expo is the expected peer dependency for expo-camera; part of the official Expo SDK ecosystem. ai
dependencies unvetted-dep:barcode-detector AI (dependencies): barcode-detector is a legitimate runtime dependency for camera barcode detection; stable for this package. ai

Versions (showing 97 of 197)

Hide prereleases
Version Deps Published
13.8.0 1 / 1
13.7.0 1 / 1
13.6.0 1 / 1
13.5.1 2 / 1
13.5.0 2 / 1
13.4.4 1 / 1
13.4.3 2 / 1
13.4.2 2 / 1
13.4.1 2 / 1
13.4.0 2 / 1
13.3.0 2 / 1
13.2.1 2 / 1
13.2.0 2 / 1
13.1.0 2 / 1
13.0.0 2 / 1
12.5.0 3 / 1
12.4.0 3 / 1
12.3.0 3 / 1
12.2.0 3 / 1
12.1.2 3 / 1
12.1.1 3 / 1
12.1.0 3 / 1
12.0.3 4 / 1
12.0.2 4 / 1
12.0.1 4 / 1
12.0.0 4 / 1
11.3.1 4 / 1
11.3.0 4 / 1
11.2.2 4 / 1
11.2.1 4 / 1
11.2.0 4 / 1
11.1.1 4 / 1
11.1.0 4 / 1
11.0.3 4 / 1
11.0.2 3 / 1
11.0.1 3 / 1
11.0.0 3 / 1
10.0.0 4 / 1
9.1.1 3 / 1
9.1.0 3 / 1
9.0.0 3 / 1
8.3.1 4 / 1
8.3.0 4 / 1
8.2.0 2 / 1
8.1.0 2 / 1
8.0.0 2 / 1
7.0.0 2 / 1
6.0.0 2 / 1
5.0.1 2 / 1
5.0.0 2 / 1
4.0.0 2 / 1
3.0.0 2 / 1
2.0.0 2 / 1
1.2.0 8 / 0
1.1.1 8 / 0
1.1.0 8 / 0
1.0.2 7 / 5
1.0.1 7 / 5
1.0.0 7 / 6
56.0.0-canary-20260420-2ac87c0 1 / 3
56.0.0-canary-20260417-141204f 1 / 3
56.0.0-canary-20260414-e3dbafd 1 / 3
56.0.0-canary-20260409-6fc2991 1 / 3
56.0.0-canary-20260402-87c5ce2 1 / 1
56.0.0-canary-20260305-5163746 1 / 1
56.0.0-canary-20260212-4f61309 1 / 1
55.0.12-canary-20260402-9da566b 1 / 1
55.0.12-canary-20260401-5e87ef7 1 / 1
55.0.12-canary-20260328-bdc6273 1 / 1
55.0.12-canary-20260328-2049187 1 / 1
55.0.12-canary-20260327-0789fbc 1 / 1
55.0.4-canary-20260128-67ce8d5 1 / 1
55.0.0-canary-20260223-05214f1 1 / 1
17.1.0-canary-20260121-a63c0dd 1 / 1
17.1.0-canary-20260120-bb71700 1 / 1
17.1.0-canary-20260119-70f7c28 1 / 1
17.1.0-canary-20260114-d8e19f5 1 / 1
17.1.0-canary-20260113-4879b86 1 / 1
17.1.0-canary-20260113-0ce2b9c 1 / 1
17.1.0-canary-20260105-6b962e6 1 / 1
17.1.0-canary-20251230-fc48ddc 1 / 1
17.1.0-canary-20251223-b83b31e 1 / 1
17.1.0-canary-20251216-6e1f9a7 1 / 1
17.1.0-canary-20251216-3f01dbf 1 / 1
17.1.0-canary-20251212-acb11f2 1 / 1
17.1.0-canary-20251211-7da85ea 1 / 1
17.1.0-canary-20251210-1f163e3 1 / 1
17.1.0-canary-20251206-615dec1 1 / 1
17.1.0-canary-20251205-a1dedc6 1 / 1
17.1.0-canary-20251205-756eb7a 1 / 1
17.1.0-canary-20251127-587bc53 1 / 1
17.1.0-canary-20251120-e46b3cc 1 / 1
17.1.0-canary-20251119-961a032 1 / 1
17.1.0-canary-20251118-8f7ee64 1 / 1
17.1.0-canary-20251118-4ca99d5 1 / 1
17.1.0-canary-20251031-b135dff 1 / 1
17.0.11-canary-20260119-17896bf 1 / 1

v13.6.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v13.4.2

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.2.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.2.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.1.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.1.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.0.3

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v11.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v5.0.1

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v4.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v3.0.0

1 finding
LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v17.1.0-canary-20260119-70f7c28

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v17.1.0-canary-20251120-e46b3cc

3 findings
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

INFO Missing gitHead — previous versions had it provenance

[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: expo-bot.

INFO Publisher changed: brentvatne → expo-bot (on 2025-11-20) provenance

[Accepted risk] This version was published by a different npm account than previous versions on 2025-11-20. This could indicate a legitimate maintainer transition or an account compromise.