828 matches found
MAL-2026-13495 Malicious code in blekit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce64fb8d6264bfc9affaf6b3544637cb8559b232075b70a48144e5f1c1743020 blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module consoleApp/initializeLogger/getCurrentStatus from...
Malicious code in react-native-ui-message (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615dd38493e2ff2257cfe5fe94b089a9001329b0d68c6b48f7ac491e4fcb205f [email protected] declares a postinstall hook that runs src/utilities/SubscriptionGuard.js. On install the script enumerates non-internal...
hermes-decomp v0.2.1
Rust decompiler for Hermes bytecode .hbc, the JS engine behind React Native. Supports HBC 40 to 99. Install Pre-built binaries Linux / macOS / Windows from Releases or Actions: Asset suffix| Platform ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664| macOS windows-x8664| Windows...
MAL-2026-12053 Malicious code in tui-react-mobile-styles (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30d6926a3b8c5bc55e60b4d4f98b2e06fb6c04608bb9442058516814dfb54f1b The package presents itself as a React Native/mobile UI styles library but at module load time performs a full binary dropper chain. index.js...
Malicious code in tui-react-mobile-styles (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30d6926a3b8c5bc55e60b4d4f98b2e06fb6c04608bb9442058516814dfb54f1b The package presents itself as a React Native/mobile UI styles library but at module load time performs a full binary dropper chain. index.js...
Malicious code in @qlik/react-native-simple-grid (npm)
npm/@qlik/react-native-simple-grid is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11769 Malicious code in @ornikar/react-native-svg-transformer (npm)
npm/@ornikar/react-native-svg-transformer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojaniz...
CLSA-2026-1778114659 TuxCare security update for @react-native-community (1 CVE)
TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.7-tuxcare.1...
CLSA-2026-1778114660 TuxCare security update for @react-native-community (1 CVE)
TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.6.9-tuxcare.1...
CLSA-2026-1777941835 TuxCare security update for @react-native-community (1 CVE)
TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 11.4.1-tuxcare.1...
CLSA-2026-1778114661 TuxCare security update for @react-native-community (1 CVE)
TuxCare rebuilt 14 @react-native-community packages to address 1 CVE. Fixed in 15.1.3-tuxcare.1...
PT-2026-74695
TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 12.3.7-tuxcare.1...
PT-2026-74696
TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 13.6.9-tuxcare.1...
PT-2026-74682
TuxCare rebuilt 12 @react-native-community packages to address 1 CVE. Fixed in 11.4.1-tuxcare.1...
PT-2026-74697
TuxCare rebuilt 14 @react-native-community packages to address 1 CVE. Fixed in 15.1.3-tuxcare.1...
CVE-2026-18648: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...
hermes-decomp v0.2.0
Rust decompiler for Hermes bytecode .hbc, the JS engine behind React Native. Supports HBC 40 to 99. Install Pre-built binaries Linux / macOS / Windows from Releases or Actions: Asset suffix| Platform ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664| macOS windows-x8664| Windows...
Malicious Package
Overview @longzy/react-native-polyfill is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...