Critical Malicious Code Vulnerability in react-native-use-modal Package
Summary
MAL-2025-190779: Malicious code in react-native-use-modal (npm). Affects react-native-use-modal versions 1.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The react-native-use-modal package is a utility for managing modal components in React Native applications. It provides developers with a simple way to implement modals, enhancing user experience. However, this package has been identified as containing malicious code, posing significant security risks to any application that utilizes it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the react-native-use-modal package, specifically in version 1.0.3. This code can compromise any computer that has the package installed, allowing unauthorized access to sensitive information such as secrets and keys. The ramifications of this vulnerability are severe, as it can lead to full control of the affected system by an external entity, making it imperative for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall react-native-use-modalIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no direct workarounds for this vulnerability other than removing the affected package. Consider using alternative modal management libraries that do not have known vulnerabilities.
Conclusion
The react-native-use-modal package has been identified as containing malicious code that poses a significant security risk. Users are advised to remove the package immediately and take steps to secure any compromised information. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for react-native-use-modal →
FAQ
It is a utility for managing modal components in React Native applications, providing developers with an easy way to implement modals.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to use the Vulert playground without signing up.
Immediately uninstall the react-native-use-modal package and rotate any sensitive information that may have been compromised.
No, there is currently no patched version available for this package, making it essential to avoid using it.
Leaving this vulnerability unaddressed can lead to unauthorized access to your system, potential data breaches, and loss of sensitive information.
