Hackers Exploit Metro4Shell RCE Flaw in React Native CLI npm Package
Threat actors have been seen taking advantage of a serious security vulnerability in the well-known "@react-native-community/cli" npm package that affects the Metro Development Server.
According to cybersecurity firm VulnCheck, exploitation of CVE-2025-11953, also known as Metro4Shell, was first noticed on December 21, 2025. The vulnerability, which has a CVSS score of 9.8, enables remote unauthenticated attackers to run arbitrary operating system commands on the underlying host. JFrog originally reported the flaw's specifics in November 2025.
It further stated that the "activity has yet to see broad public acknowledgment," even after it was first exploited in the wild more than a month ago.
The threat actors have exploited the vulnerability in the attack that was discovered agai...