There's a new major malware / worm / supply chain attack that affects React Native packages (among plenty of others) that my fellow RN / Expo devs should be aware of. I'll link to an article about it in the next tweet.
It's called shai-hulud 2 and it grabs env secrets from CI or your local machine and publishes public Github repos with them exposed to the world.
Some of the RN/Expo packages that were affected (non-exhaustive, won't add version # -- look it up):
actbase/css-to-react-native-transform
rn-zustand-expo-template
seung-ju/react-native-action-sheet
strapbuild/react-native-date-time-picker
strapbuild/react-native-perspective-image-cropper
strapbuild/react-native-perspective-image-cropper-poojan31
posthog-react-native
posthog-react-native-session-replay
react-native-datepicker-modal
react-native-email
react-native-fetch
react-native-get-pixel-dimensions
react-native-google-maps-directions
react-native-jam-icons
react-native-log-level
react-native-modest-checkbox
react-native-modest-storage
react-native-phone-call
react-native-retriable-fetch
react-native-use-modal
react-native-view-finder
react-native-websocket
react-native-worklet-functions
expo-audio-session
expo-router-on-rails
(probably others)
Links to more info next.
(I am not a security consultant -- just doing my best to get the word out there.)