CVE-2026-48160

CVE-2026-48160 (react-tracked) describes malicious commits on the default branch that, during npm install, could execute attacker-controlled code on developer machines. The window between 2026-05-18 19:26:36 and 2026-05-19 15:22:45 included commits 6978272a7d6ca02225cb747ea69f427512e33699 through...

React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

Malicious code in iconova-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4590534a7b05eb30959d9422e2ea700fb525b66b357a62f7ba1795caba4ad799 iconova-react is a re-hosted copy of lucide-react every icon file carries a @license lucide-react header; the package name is iconova-react but its...

MAL-2026-13705 Malicious code in iconova-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4590534a7b05eb30959d9422e2ea700fb525b66b357a62f7ba1795caba4ad799 iconova-react is a re-hosted copy of lucide-react every icon file carries a @license lucide-react header; the package name is iconova-react but its...

ROOT-APP-NPM-CVE-2026-55685 CVE-2026-55685 in react-router - Patched by Root

Root has patched CVE-2026-55685 in the react-router package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-53663 CVE-2026-53663 in react-router - Patched by Root

Root has patched CVE-2026-53663 in the react-router package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-QWWW-VCR4-C8H2 GHSA-qwww-vcr4-c8h2 in react-router - Patched by Root

Root has patched GHSA-qwww-vcr4-c8h2 in the react-router package for Root:npm. Multiple fixed versions available...

EUVD-2026-54837

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182---Advanced-React-Server-Components-RCE-Exploit...

MAL-2026-13495 Malicious code in blekit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce64fb8d6264bfc9affaf6b3544637cb8559b232075b70a48144e5f1c1743020 blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module consoleApp/initializeLogger/getCurrentStatus from...

MAL-2026-12726 Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...

Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

MAL-2026-12742 Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

Malicious code in devplatform-react-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422556511a13a0424a33cfdb404a289d3fd51a0f7f206b4de8114fe69a0874b6 On require'devplatform-react-form', index.js loads adapter.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers...

MAL-2026-12735 Malicious code in devplatform-react-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422556511a13a0424a33cfdb404a289d3fd51a0f7f206b4de8114fe69a0874b6 On require'devplatform-react-form', index.js loads adapter.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers...

Malicious code in devplatform-react-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15880efb2feec5e49ab725414e805293700e451ede11a2e4f3b1fe8e2f8f881c On require of the package, index.js loads helpers.js which reconstructs Cloudflare Workers hostnames via array-join string splitting...

Malicious code in wagmi-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6285993305d8ff9bbf69804dcbf929539b6f48c2ef1b1ca6e5c723150c5565ee The package impersonates the wagmi/viem wallet API surface exporting createWalletClient, parseAccount, and a WalletClient constructor and, when a...

Malicious code in react-native-ui-message (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615dd38493e2ff2257cfe5fe94b089a9001329b0d68c6b48f7ac491e4fcb205f [email protected] declares a postinstall hook that runs src/utilities/SubscriptionGuard.js. On install the script enumerates non-internal...

MAL-2026-12489 Malicious code in tui-react-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fe18ff84117bb416a0069e88f29f3ce0d3544395e20168f270d73ce757fc8df The package advertises itself as a React tooltip UI component, but index.js declared main unconditionally requires loader.js, which on module load...

Malicious code in react-table-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcbd9a8090832d59bcf70ff418611d54c1f558eb0a09927fc13895f5d654f02c package.json declares preinstall: node./dist/index.d.js, disguising an executable loader as a TypeScript declaration file. On npm install, that loade...