npm package report

Is @react-native-aria/focus safe?

Version 0.2.10 of @react-native-aria/focus was compromised. Other versions are not flagged as malicious.

Do not install @react-native-aria/focus 0.2.10

CRITICAL

Compromised releases. Added to CyberXYZ 2025-06-10, OSV malicious-package feed (Google / OpenSSF).

// what we observed

React Native ARIA and @gluestack-ui/utils had unauthorized new versions published that contained malicious code via a public access token compromise. The malicious code connects to a command and control server and allows remote access, including arbitrary command execution.

Reported by Google Open Source Security via OSV.

// versions and what to do

Malicious: 0.2.10
Move to: 0.2.9 newest 0.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install @react-native-aria/focus@0.2.9

OSV record issue reference

// reach

0 direct dependencies

none carry a known advisory

1 packages depend on it

an advisory here reaches each of them

@gluestack-ui/input

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-10-31 at 00:00 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.