I tried to publish an Expo app to the play store and it got rejected for malware.
Google says that:
your app, xxx , currently contains phishing code that pretends to come from a trustworthy source, requests a user's authentication credentials or billing information, and sends the data to a third-party. This category also applies to code that intercepts the transmission of user credentials in transit
I don't have any phishing code that I know of. There's a regular login/signup that interacts with my backend API hosted on Heroku. Payment is made via USSD.
Virus Total says that it's all good: https://www.virustotal.com/gui/file/8b057d46b2d59bb0ec3df44d47b701a6b911cba230d80ab67d871e535c06e9f6/details
Any pointers on how I can start tackling this issue?