Skip to content

Commit 62c214e

Browse files
calebbrowncalebbrown
authored
Add gluestack and react native aria compromise reports. (#927)
Signed-off-by: Caleb Brown <calebbrown@google.com>
1 parent b7e4718 commit 62c214e

17 files changed

+716
-0
lines changed

‎osv/malicious/npm/@gluestack-ui/utils/MAL-0000-google-open-source-security-17982e09dcf1a69c.json

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"modified": "2025-06-10T06:36:28Z",
3+
"published": "2025-06-10T06:36:28Z",
4+
"schema_version": "1.5.0",
5+
"id": "",
6+
"summary": "Malicious code in @gluestack-ui/utils (npm)",
7+
"details": "React Native ARIA and @gluestack-ui/utils had unauthorized new versions published\nthat contained malicious code via a public access token compromise.\n\nThe malicious code connects to a command and control server and allows\nremote access, including arbitrary command execution.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "npm",
12+
"name": "@gluestack-ui/utils"
13+
},
14+
"versions": [
15+
"0.1.16",
16+
"0.1.17"
17+
]
18+
}
19+
],
20+
"references": [
21+
{
22+
"type": "REPORT",
23+
"url": "https://github.com/gluestack/gluestack-ui/issues/2894"
24+
},
25+
{
26+
"type": "ARTICLE",
27+
"url": "https://www.aikido.dev/blog/supply-chain-attack-on-react-native-aria-ecosystem"
28+
}
29+
],
30+
"database_specific": {
31+
"malicious-packages-origins": [
32+
{
33+
"source": "google-open-source-security",
34+
"sha256": "17982e09dcf1a69caf714afad49b310371d80fe7260bf21fcad08da2a07df00c",
35+
"import_time": "2025-06-10T06:38:15.27525Z",
36+
"modified_time": "2025-06-10T06:36:28Z",
37+
"versions": [
38+
"0.1.16",
39+
"0.1.17"
40+
]
41+
}
42+
]
43+
}
44+
}

‎osv/malicious/npm/@react-native-aria/button/MAL-0000-google-open-source-security-59aea492d433f73b.json

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2025-06-10T06:36:28Z",
3+
"published": "2025-06-10T06:36:28Z",
4+
"schema_version": "1.5.0",
5+
"id": "",
6+
"summary": "Malicious code in @react-native-aria/button (npm)",
7+
"details": "React Native ARIA and @gluestack-ui/utils had unauthorized new versions published\nthat contained malicious code via a public access token compromise.\n\nThe malicious code connects to a command and control server and allows\nremote access, including arbitrary command execution.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "npm",
12+
"name": "@react-native-aria/button"
13+
},
14+
"versions": [
15+
"0.2.11"
16+
]
17+
}
18+
],
19+
"references": [
20+
{
21+
"type": "REPORT",
22+
"url": "https://github.com/gluestack/gluestack-ui/issues/2894"
23+
},
24+
{
25+
"type": "ARTICLE",
26+
"url": "https://www.aikido.dev/blog/supply-chain-attack-on-react-native-aria-ecosystem"
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "google-open-source-security",
33+
"sha256": "59aea492d433f73b670e379d9e7e5131f8b7a98b245557a4cb8cce7565baaa00",
34+
"import_time": "2025-06-10T06:38:15.237792Z",
35+
"modified_time": "2025-06-10T06:36:28Z",
36+
"versions": [
37+
"0.2.11"
38+
]
39+
}
40+
]
41+
}
42+
}

‎osv/malicious/npm/@react-native-aria/checkbox/MAL-0000-google-open-source-security-ddc6ca13c8475738.json

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2025-06-10T06:36:28Z",
3+
"published": "2025-06-10T06:36:28Z",
4+
"schema_version": "1.5.0",
5+
"id": "",
6+
"summary": "Malicious code in @react-native-aria/checkbox (npm)",
7+
"details": "React Native ARIA and @gluestack-ui/utils had unauthorized new versions published\nthat contained malicious code via a public access token compromise.\n\nThe malicious code connects to a command and control server and allows\nremote access, including arbitrary command execution.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "npm",
12+
"name": "@react-native-aria/checkbox"
13+
},
14+
"versions": [
15+
"0.2.11"
16+
]
17+
}
18+
],
19+
"references": [
20+
{
21+
"type": "REPORT",
22+
"url": "https://github.com/gluestack/gluestack-ui/issues/2894"
23+
},
24+
{
25+
"type": "ARTICLE",
26+
"url": "https://www.aikido.dev/blog/supply-chain-attack-on-react-native-aria-ecosystem"
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "google-open-source-security",
33+
"sha256": "ddc6ca13c84757389a8703ee553981d86519fdeca6112152dc3bf344c98ea337",
34+
"import_time": "2025-06-10T06:38:15.222821Z",
35+
"modified_time": "2025-06-10T06:36:28Z",
36+
"versions": [
37+
"0.2.11"
38+
]
39+
}
40+
]
41+
}
42+
}

‎osv/malicious/npm/@react-native-aria/combobox/MAL-0000-google-open-source-security-1ac997eb7889bb6a.json

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2025-06-10T06:36:28Z",
3+
"published": "2025-06-10T06:36:28Z",
4+
"schema_version": "1.5.0",
5+
"id": "",
6+
"summary": "Malicious code in @react-native-aria/combobox (npm)",
7+
"details": "React Native ARIA and @gluestack-ui/utils had unauthorized new versions published\nthat contained malicious code via a public access token compromise.\n\nThe malicious code connects to a command and control server and allows\nremote access, including arbitrary command execution.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "npm",
12+
"name": "@react-native-aria/combobox"
13+
},
14+
"versions": [
15+
"0.2.8"
16+
]
17+
}
18+
],
19+
"references": [
20+
{
21+
"type": "REPORT",
22+
"url": "https://github.com/gluestack/gluestack-ui/issues/2894"
23+
},
24+
{
25+
"type": "ARTICLE",
26+
"url": "https://www.aikido.dev/blog/supply-chain-attack-on-react-native-aria-ecosystem"
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "google-open-source-security",
33+
"sha256": "1ac997eb7889bb6aa988bf49e9beb198eb49629764c6fff1ac19cd4e8118b600",
34+
"import_time": "2025-06-10T06:38:15.258395Z",
35+
"modified_time": "2025-06-10T06:36:28Z",
36+
"versions": [
37+
"0.2.8"
38+
]
39+
}
40+
]
41+
}
42+
}

‎osv/malicious/npm/@react-native-aria/disclosure/MAL-0000-google-open-source-security-257ffc8541490ada.json

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2025-06-10T06:36:28Z",
3+
"published": "2025-06-10T06:36:28Z",
4+
"schema_version": "1.5.0",
5+
"id": "",
6+
"summary": "Malicious code in @react-native-aria/disclosure (npm)",
7+
"details": "React Native ARIA and @gluestack-ui/utils had unauthorized new versions published\nthat contained malicious code via a public access token compromise.\n\nThe malicious code connects to a command and control server and allows\nremote access, including arbitrary command execution.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "npm",
12+
"name": "@react-native-aria/disclosure"
13+
},
14+
"versions": [
15+
"0.2.9"
16+
]
17+
}
18+
],
19+
"references": [
20+
{
21+
"type": "REPORT",
22+
"url": "https://github.com/gluestack/gluestack-ui/issues/2894"
23+
},
24+
{
25+
"type": "ARTICLE",
26+
"url": "https://www.aikido.dev/blog/supply-chain-attack-on-react-native-aria-ecosystem"
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "google-open-source-security",
33+
"sha256": "257ffc8541490ada2a41d7f56aac16d0a9eb9c789be4858a9fb6243c31937ef6",
34+
"import_time": "2025-06-10T06:38:15.263201Z",
35+
"modified_time": "2025-06-10T06:36:28Z",
36+
"versions": [
37+
"0.2.9"
38+
]
39+
}
40+
]
41+
}
42+
}

‎osv/malicious/npm/@react-native-aria/focus/MAL-0000-google-open-source-security-f417c0ca8632369f.json

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2025-06-10T06:36:28Z",
3+
"published": "2025-06-10T06:36:28Z",
4+
"schema_version": "1.5.0",
5+
"id": "",
6+
"summary": "Malicious code in @react-native-aria/focus (npm)",
7+
"details": "React Native ARIA and @gluestack-ui/utils had unauthorized new versions published\nthat contained malicious code via a public access token compromise.\n\nThe malicious code connects to a command and control server and allows\nremote access, including arbitrary command execution.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "npm",
12+
"name": "@react-native-aria/focus"
13+
},
14+
"versions": [
15+
"0.2.10"
16+
]
17+
}
18+
],
19+
"references": [
20+
{
21+
"type": "REPORT",
22+
"url": "https://github.com/gluestack/gluestack-ui/issues/2894"
23+
},
24+
{
25+
"type": "ARTICLE",
26+
"url": "https://www.aikido.dev/blog/supply-chain-attack-on-react-native-aria-ecosystem"
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "google-open-source-security",
33+
"sha256": "f417c0ca8632369f18fa208f418b61b3150122f048ba95cbf4b0ab78dc4f20c2",
34+
"import_time": "2025-06-10T06:38:15.181948Z",
35+
"modified_time": "2025-06-10T06:36:28Z",
36+
"versions": [
37+
"0.2.10"
38+
]
39+
}
40+
]
41+
}
42+
}

‎osv/malicious/npm/@react-native-aria/interactions/MAL-0000-google-open-source-security-0ebff3f8886f25a3.json

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2025-06-10T06:36:28Z",
3+
"published": "2025-06-10T06:36:28Z",
4+
"schema_version": "1.5.0",
5+
"id": "",
6+
"summary": "Malicious code in @react-native-aria/interactions (npm)",
7+
"details": "React Native ARIA and @gluestack-ui/utils had unauthorized new versions published\nthat contained malicious code via a public access token compromise.\n\nThe malicious code connects to a command and control server and allows\nremote access, including arbitrary command execution.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "npm",
12+
"name": "@react-native-aria/interactions"
13+
},
14+
"versions": [
15+
"0.2.17"
16+
]
17+
}
18+
],
19+
"references": [
20+
{
21+
"type": "REPORT",
22+
"url": "https://github.com/gluestack/gluestack-ui/issues/2894"
23+
},
24+
{
25+
"type": "ARTICLE",
26+
"url": "https://www.aikido.dev/blog/supply-chain-attack-on-react-native-aria-ecosystem"
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "google-open-source-security",
33+
"sha256": "0ebff3f8886f25a3adc58387ba0a97c3768c3c88e8f4c09d8562b92b0fdbbd7f",
34+
"import_time": "2025-06-10T06:38:15.205007Z",
35+
"modified_time": "2025-06-10T06:36:28Z",
36+
"versions": [
37+
"0.2.17"
38+
]
39+
}
40+
]
41+
}
42+
}

‎osv/malicious/npm/@react-native-aria/listbox/MAL-0000-google-open-source-security-7483620e07f1df85.json

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2025-06-10T06:36:28Z",
3+
"published": "2025-06-10T06:36:28Z",
4+
"schema_version": "1.5.0",
5+
"id": "",
6+
"summary": "Malicious code in @react-native-aria/listbox (npm)",
7+
"details": "React Native ARIA and @gluestack-ui/utils had unauthorized new versions published\nthat contained malicious code via a public access token compromise.\n\nThe malicious code connects to a command and control server and allows\nremote access, including arbitrary command execution.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "npm",
12+
"name": "@react-native-aria/listbox"
13+
},
14+
"versions": [
15+
"0.2.10"
16+
]
17+
}
18+
],
19+
"references": [
20+
{
21+
"type": "REPORT",
22+
"url": "https://github.com/gluestack/gluestack-ui/issues/2894"
23+
},
24+
{
25+
"type": "ARTICLE",
26+
"url": "https://www.aikido.dev/blog/supply-chain-attack-on-react-native-aria-ecosystem"
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "google-open-source-security",
33+
"sha256": "7483620e07f1df855fba9750b8b752f9ec4ce35723c1920562bc7c2f86cf2c6d",
34+
"import_time": "2025-06-10T06:38:15.248628Z",
35+
"modified_time": "2025-06-10T06:36:28Z",
36+
"versions": [
37+
"0.2.10"
38+
]
39+
}
40+
]
41+
}
42+
}

‎osv/malicious/npm/@react-native-aria/menu/MAL-0000-google-open-source-security-8890be818fee58f3.json

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"modified": "2025-06-10T06:36:28Z",
3+
"published": "2025-06-10T06:36:28Z",
4+
"schema_version": "1.5.0",
5+
"id": "",
6+
"summary": "Malicious code in @react-native-aria/menu (npm)",
7+
"details": "React Native ARIA and @gluestack-ui/utils had unauthorized new versions published\nthat contained malicious code via a public access token compromise.\n\nThe malicious code connects to a command and control server and allows\nremote access, including arbitrary command execution.\n",
8+
"affected": [
9+
{
10+
"package": {
11+
"ecosystem": "npm",
12+
"name": "@react-native-aria/menu"
13+
},
14+
"versions": [
15+
"0.2.16"
16+
]
17+
}
18+
],
19+
"references": [
20+
{
21+
"type": "REPORT",
22+
"url": "https://github.com/gluestack/gluestack-ui/issues/2894"
23+
},
24+
{
25+
"type": "ARTICLE",
26+
"url": "https://www.aikido.dev/blog/supply-chain-attack-on-react-native-aria-ecosystem"
27+
}
28+
],
29+
"database_specific": {
30+
"malicious-packages-origins": [
31+
{
32+
"source": "google-open-source-security",
33+
"sha256": "8890be818fee58f3ddcfc7238753e75234d4f0d165160e786b299d128172ff69",
34+
"import_time": "2025-06-10T06:38:15.243813Z",
35+
"modified_time": "2025-06-10T06:36:28Z",
36+
"versions": [
37+
"0.2.16"
38+
]
39+
}
40+
]
41+
}
42+
}

0 commit comments

Comments
 (0)