← Home

expo-file-system

npm Repository Homepage

Provides access to the local file system on the device.

100
Versions
MIT
License
No
Install Scripts
Missing
Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

idebrentvatneexpoadminexponentbycedrickudochienalanhughestsapetaexpo-botphilplwschurmanccheeverjesseruderterriblebensjchmielaesamelson

Keywords

react-nativeexpofile-systemfile

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance missing-githead AI (provenance): Canary releases from expo-bot's automated pipeline may omit gitHead; all other metadata matches the legitimate expo/expo repository and publisher track record is strong. ai
publish-pattern suspicious-version-number AI (publish-pattern): Canary version numbering pattern is standard for the Expo ecosystem; not indicative of malicious intent for this well-established package. ai
provenance no-provenance AI (provenance): Established Expo monorepo package with a highly trusted publisher track record; lack of Sigstore provenance is not a meaningful risk signal here. ai
maintainer-change maintainer-added AI (maintainer-change): New maintainers (douglowder, betoatexpo, philpl, expo-bot) are all associated with the Expo organization; expo-bot is a known Expo automation account. Legitimate team evolution. ai
bogus-package bogus-package AI (bogus-package): expo-file-system is a legitimate, well-established Expo SDK package with 285 versions. The v0.0.1 stub signals are artifacts of an early placeholder release ~8 years ago, not spam or malice. ai
provenance publisher-changed AI (provenance): brentvatne is a core Expo team member with a strong track record (211 approved, 0 rejected). Publisher rotation within the Expo org is expected and not a risk signal. ai
maintainer-change maintainer-removed AI (maintainer-change): Maintainer changes within the Expo organization are routine team restructuring; no external actors involved. ai
semgrep semgrep:shady-links-raw-ip AI (semgrep): The raw IP (192.168.0.1) appears only in a JSDoc comment as a usage example for uploadAsync — it is documentation, not live network code. ai

Versions (showing 100 of 160)

Show 38 prereleases
Version Deps Published
57.0.1 0 / 4
57.0.0 0 / 4
56.0.8 0 / 4
56.0.7 0 / 4
56.0.6 0 / 4
56.0.5 0 / 4
56.0.4 0 / 4
56.0.3 0 / 4
56.0.2 0 / 4
56.0.1 0 / 3
56.0.0 0 / 3
55.0.24 0 / 2
55.0.23 0 / 2
55.0.22 0 / 2
55.0.21 0 / 2
55.0.20 0 / 2
55.0.19 0 / 2
55.0.18 0 / 2
55.0.17 0 / 2
55.0.16 0 / 2
55.0.15 0 / 2
55.0.14 0 / 2
55.0.13 0 / 2
55.0.12 0 / 2
55.0.11 0 / 2
55.0.10 0 / 2
55.0.9 0 / 2
55.0.8 0 / 2
55.0.7 0 / 2
55.0.6 0 / 2
55.0.5 0 / 2
55.0.4 0 / 2
55.0.3 0 / 2
55.0.2 0 / 2
55.0.1 0 / 2
55.0.0 0 / 2
19.0.23 0 / 2
19.0.22 0 / 2
19.0.21 0 / 2
19.0.20 0 / 2
19.0.19 0 / 2
19.0.18 0 / 2
19.0.17 0 / 2
19.0.16 0 / 2
19.0.15 0 / 2
19.0.14 0 / 2
19.0.13 0 / 2
19.0.12 0 / 2
19.0.11 0 / 2
19.0.10 0 / 2
19.0.9 0 / 2
19.0.8 0 / 2
19.0.7 0 / 2
19.0.6 0 / 2
19.0.5 0 / 2
19.0.4 0 / 2
19.0.3 0 / 2
19.0.2 0 / 2
19.0.1 0 / 2
19.0.0 0 / 2
18.1.11 0 / 2
18.1.10 0 / 2
18.1.9 0 / 2
18.1.8 0 / 2
18.1.7 0 / 2
18.1.6 1 / 2
18.1.5 1 / 2
18.1.4 1 / 2
18.1.3 1 / 2
18.1.2 1 / 2
18.1.1 1 / 2
18.1.0 1 / 2
18.0.12 1 / 2
18.0.11 1 / 2
18.0.10 1 / 2
18.0.9 1 / 2
18.0.8 1 / 2
18.0.7 1 / 2
18.0.6 1 / 2
18.0.5 1 / 2
18.0.4 1 / 2
18.0.3 1 / 2
18.0.2 0 / 2
18.0.1 0 / 2
18.0.0 0 / 2
17.0.1 0 / 2
17.0.0 0 / 2
16.0.9 0 / 2
16.0.8 0 / 2
16.0.7 0 / 2
16.0.6 0 / 2
16.0.5 0 / 2
16.0.4 0 / 2
16.0.3 0 / 2
16.0.2 0 / 2
16.0.1 0 / 2
16.0.0 1 / 2
15.9.0 1 / 2
15.8.0 1 / 2
15.7.0 1 / 2
Showing 100 of 160 Next page →

v57.0.1

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v55.0.24

1 finding
INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.