Critical React Native Metro dev server bug under attack as researchers scream into the void

A critical command-injection vulnerability (CVE-2025-11953) in the React Native Community Metro development server is being actively exploited in the wild to deliver multi-stage malware to Windows and Linux systems. Researchers observed attacks starting in December that used a PowerShell-based loader to disable Microsoft Defender and fetch Rust-based binaries with anti-analysis features; proof-of-concept code and multiple payload-hosting IPs were identified, and the flaw affects a widely used npm package.