Embedded Malicious Code Affecting react-native-country-select package, versions =0.3.91
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-REACTNATIVECOUNTRYSELECT-15670121
- published16 Mar 2026
- disclosed15 Mar 2026
- creditSai Likhith
Introduced: 15 Mar 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the react-native-country-select package.
Overview
react-native-country-select is a 🌍 React Native country picker with flags, search, TypeScript, i18n, and offline support. Lightweight, customizable, and designed with a modern UI.
Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised and a malicious version was released on NPM. It contains malicious code, and its content was removed from the official package manager.
A preinstall script was added in install.js that enables delivery of an AES-encrypted stage-2 payload with keys delivered via HTTP headers.
According to the reporter, there is high likelihood that this attack is carried out by the same actors ForceMemo (GlassWorm group).