Hello maintainers 👋 , I wanted to point out the following suspicious situation in your NPM releases:
Summary
A version 999.999.991 of react-native-ui-lib was published to the public npm registry on 2026-09-06 at 12:30:35 UTC. It is an empty 3-file stub ("Temporary test package") with all legitimate code, dependencies, and package metadata stripped. It is currently not deprecated and remains resolvable.
latest still points to 9.1.3, but any consumer using a loose semver range (*, x, >=9.x) will resolve to 999.999.991 and get an empty module, breaking their build.
This inflated version is often used as a supply chain attack technique to hijack dependency resolution in environments that resolve to the highest available version. Also all 69,181 lines of legitimate package code have been removed and replaced with an empty stub (module.exports = {}) and The package metadata has been stripped of all author, repository, and dependency information, replaced with "Temporary test package" and UNLICENSED license.
About attribution and suggested actions
The npm registry metadata shows this version was published by the niryo account, which is on this package's official maintainer list.
This might have been an accidental test publish, either way, I suggest to verify the niryo npm account to confirm the publish was intentional and check his account for potential compromise.
Hello maintainers 👋 , I wanted to point out the following suspicious situation in your NPM releases:
Summary
A version
999.999.991ofreact-native-ui-libwas published to the public npm registry on 2026-09-06 at 12:30:35 UTC. It is an empty 3-file stub ("Temporary test package") with all legitimate code, dependencies, and package metadata stripped. It is currently not deprecated and remains resolvable.lateststill points to9.1.3, but any consumer using a loose semver range (*,x,>=9.x) will resolve to999.999.991and get an empty module, breaking their build.This inflated version is often used as a supply chain attack technique to hijack dependency resolution in environments that resolve to the highest available version. Also all 69,181 lines of legitimate package code have been removed and replaced with an empty stub (
module.exports = {}) and The package metadata has been stripped of all author, repository, and dependency information, replaced with "Temporary test package" and UNLICENSED license.About attribution and suggested actions
The npm registry metadata shows this version was published by the
niryoaccount, which is on this package's official maintainer list.This might have been an accidental test publish, either way, I suggest to verify the
niryonpm account to confirm the publish was intentional and check his account for potential compromise.