John Forte

There's a new major malware / worm / supply chain attack that affects React Native packages (among plenty of others) that my fellow RN / Expo devs should be aware of. I'll link to an article about it in the next tweet. It's called shai-hulud 2 and it grabs env secrets from CI or your local machine and publishes public Github repos with them exposed to the world. Some of the RN/Expo packages that were affected (non-exhaustive, won't add version # -- look it up): actbase/css-to-react-native-transform rn-zustand-expo-template seung-ju/react-native-action-sheet strapbuild/react-native-date-time-picker strapbuild/react-native-perspective-image-cropper strapbuild/react-native-perspective-image-cropper-poojan31 posthog-react-native posthog-react-native-session-replay react-native-datepicker-modal react-native-email react-native-fetch react-native-get-pixel-dimensions react-native-google-maps-directions react-native-jam-icons react-native-log-level react-native-modest-checkbox react-native-modest-storage react-native-phone-call react-native-retriable-fetch react-native-use-modal react-native-view-finder react-native-websocket react-native-worklet-functions expo-audio-session expo-router-on-rails (probably others) Links to more info next. (I am not a security consultant -- just doing my best to get the word out there.)