MAL-2025-4792 Malicious code in @react-native-aria/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 86110b8ddeafc0fbfe05bcb49e82cc1047aca664d73928c3c12bac00f4ab4e7d React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

MAL-2025-4779 Malicious code in @react-native-aria/combobox (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1ac997eb7889bb6aa988bf49e9beb198eb49629764c6fff1ac19cd4e8118b600 React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

MAL-2025-4790 Malicious code in @react-native-aria/tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 9b37ef96f1f4f67e95f3c2e425a1e3ec62db2db5ef00217c25bf38990a69ec28 React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

MAL-2025-4781 Malicious code in @react-native-aria/focus (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security f417c0ca8632369f18fa208f418b61b3150122f048ba95cbf4b0ab78dc4f20c2 React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

MAL-2025-4778 Malicious code in @react-native-aria/checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security ddc6ca13c84757389a8703ee553981d86519fdeca6112152dc3bf344c98ea337 React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

MAL-2025-4791 Malicious code in @react-native-aria/toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 97ba08618fb93f76ae71922e2a9212ad64a743b1bff038fb70c33753273cb245 React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

MAL-2025-4780 Malicious code in @react-native-aria/disclosure (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 257ffc8541490ada2a41d7f56aac16d0a9eb9c789be4858a9fb6243c31937ef6 React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

MAL-2025-4786 Malicious code in @react-native-aria/radio (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security b98adedbfc9e23f5ef035b1fd6980aa12fd3724f01d871eae73a3398fefe89a3 React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

MAL-2025-4785 Malicious code in @react-native-aria/overlays (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security b750f7d8494a011a02c4c74b8b68b56f54c51cb02b85cf9728c80cb1eef574e1 React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

MAL-2025-4783 Malicious code in @react-native-aria/listbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 7483620e07f1df855fba9750b8b752f9ec4ce35723c1920562bc7c2f86cf2c6d React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

MAL-2025-4787 Malicious code in @react-native-aria/separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security c4f88a3038167bc7dfee653f5f7da062761079e770fccd80c28832842ac9c014 React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

MAL-2025-4784 Malicious code in @react-native-aria/menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 8890be818fee58f3ddcfc7238753e75234d4f0d165160e786b299d128172ff69 React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

MAL-2025-4788 Malicious code in @react-native-aria/slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 3e5580844fc6f63010dfda70e7d9c4cebd2672099bb2d66c49ebbe671f511ba1 React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

MAL-2025-4776 Malicious code in @gluestack-ui/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 17982e09dcf1a69caf714afad49b310371d80fe7260bf21fcad08da2a07df00c React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token...

Malicious code in react-native-atob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b91f4867862f09ae93e8c5413e74fc6e717d421419c933ef721bf15df14c6e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4873 Malicious code in react-native-atob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b91f4867862f09ae93e8c5413e74fc6e717d421419c933ef721bf15df14c6e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@agreejs/cli (>=0.0.1 <=3.2.43), @agreejs/rn-runner (>=3.2.1 <=3.2.15) +98 more potentially affected by CVE-2025-5896 via taro-css-to-react-native (>=1.3.0-beta.1 <=4.1.2-alpha.2)

taro-css-to-react-native NPM version =1.3.0-beta.1, =0.0.1, =3.2.1, =3.2.1, =1.0.0, =1.0.0, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0, =1.1.5, =1.0.0, =1.3.2 - @c-art/convert-cli =1.1.0 - @d-bigfish/cli =1.0.14 - @d1m-atom/taro-vue-cli =1.0.5 and more Source cves: CVE-2025-5896 Source advisory:...

GHSA-F5XG-CFPJ-2MW6 taro-css-to-react-native Regular Expression Denial of Service vulnerability

A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely...

GHSA-FJ44-H6XW-896G react-native-keys insecurely stores encryption cipher and Base64 chunks

react-native-keys 0.7.11 is vulnerable to sensitive information disclosure remote as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools...

CVE-2025-45001

react-native-keys 0.7.11 is vulnerable to sensitive information disclosure remote as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools...