PT-2026-99407

TuxCare rebuilt 14 @react-native-community packages to address 1 CVE. Fixed in 15.1.3-tuxcare.2...

PT-2026-99408

TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.7-tuxcare.2...

hermes-decomp v0.2.3

Rust decompiler for Hermes bytecode .hbc, the JS engine behind React Native. Supports HBC 40 to 99. Install Pre-built binaries Linux / macOS / Windows from Releases or Actions: Asset suffix| Platform ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664| macOS windows-x8664| Windows...

CVE-2026-84685

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

CVE-2026-84685 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

CVE-2026-84685

The react-native-auth0 SDK 's web platform implementation fails to scope its in-memory token cache to individual user sessions in server-side rendering (SSR) environments where module state persists across HTTP requests. As a result, tokens cached in module memory can be retrieved by subsequent r...

EUVD-2026-74189

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

CVE-2026-84685 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

MAL-2026-16042 Malicious code in krdpass-auth-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...

Malicious code in krdpass-auth-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...

PT-2026-88449

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

CVE-2026-84685: Exposure of Data Element to Wrong Session

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

Malicious Package

Overview krdpass-auth-react-native is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

ROOT-APP-NPM-CVE-2024-25466 CVE-2024-25466 in react-native-document-picker - Patched by Root

Root has patched CVE-2024-25466 in the react-native-document-picker package for Root:npm. Multiple fixed versions available...

Malicious Package

Overview amplitude-react-native is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious code in amplitude-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489592652dd724254e29c10536019e0e03e8032e781748a73fc357bb40f50a1d package.json declares a single dependency whose source is a bare HTTPS URL https://repo.securityctrl.com/amplitude-react-native rather than a registr...

MAL-2026-15525 Malicious code in amplitude-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489592652dd724254e29c10536019e0e03e8032e781748a73fc357bb40f50a1d package.json declares a single dependency whose source is a bare HTTPS URL https://repo.securityctrl.com/amplitude-react-native rather than a registr...

Malicious Package

Overview hyperion-react-native-testapp is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview react-native-ui-message is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

hermes-decomp v0.2.2

Rust decompiler for Hermes bytecode .hbc, the JS engine behind React Native. Supports HBC 40 to 99. Install Pre-built binaries Linux / macOS / Windows from Releases or Actions: Asset suffix| Platform ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664| macOS windows-x8664| Windows...