Hackers abused React Native CLI flaw to deploy Rust malware before public disclosure

A critical command-injection flaw (CVE-2025-11953, "Metro4Shell") in the React Native CLI Metro dev server is being actively exploited in the wild to run arbitrary commands and deploy a UPX-packed Rust malware via a multi-stage PowerShell loader; researchers observed sustained exploitation weeks before broad disclosure and published IoCs including exploitation sources and payload hosts.