
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
expo-quest-location
Advanced tools
A fork of expo-location that provides two implementations: The default expo-location behavior using Google Play Services. A Meta Quest-compatible implementation that does not rely on Google Play Services.
A fork of expo-location that provides two implementations:
expo-location behavior using Google Play Services.You can choose which implementation to use with the EXPO_HORIZON environment variable.
This makes it compatible with Meta Quest devices, while remaining a drop-in replacement for expo-location on Android and iOS.
npx expo install expo-quest-location
app.json / app.config.js to replace expo-location with expo-quest-location.export EXPO_HORIZON=1 environment variable set (to return to the type just remove the environment variable: unset EXPO_HORIZON).import * as Location from 'expo-quest-location';
EXPO_HORIZON=1 → Uses the Meta Quest–compatible location API (no Google Play Services).EXPO_HORIZON → Falls back to the default expo-location behavior (Google Play Services Location API).EXPO_HORIZON flag has no effect; behavior is always the same as expo-location.[!IMPORTANT] The
EXPO_HORIZONversion is intended specifically for Meta Quest devices. Using it on standard Android devices is not recommended, as certain features may be unsupported or behave differently.
This ensures compatibility across Quest, standard Android devices, and iOS.
Location.isQuest() → Returns true if the device is a Meta Quest device.| Function Name | Android Devices | Meta Quest | Notes |
|---|---|---|---|
enableNetworkProviderAsync | ✅ Supported | ✅ Supported | |
getProviderStatusAsync | ✅ Supported | ✅ Supported | |
hasServicesEnabledAsync | ✅ Supported | ✅ Supported | |
requestForegroundPermissionsAsync requestBackgroundPermissionsAsync | ✅ Supported | ✅ Supported | |
getForegroundPermissionsAsync getBackgroundPermissionsAsync | ✅ Supported | ✅ Supported | |
getCurrentPositionAsync watchPositionAsync | ✅ Supported | ✅ Supported | The GPS provider is not available on Quest devices. If selected, the network provider will be used instead. Note that, based on experiments, the network provider updates no more frequently than every 10 minutes. |
getLastKnownPositionAsync | ✅ Supported | ✅ Supported | |
watchHeadingAsync getHeadingAsync | ✅ Supported | ❌ Not supported | Magnetic and accelerometer sensors are not available on Quest. |
geocodeAsync reverseGeocodeAsync | ✅ Supported | ❌ Not supported | The Geocoder is not present on Quest. |
startGeofencingAsync stopGeofencingAsync hasStartedGeofencingAsync | ✅ Supported | ❌ Not supported | Meta Horizon Store doesn't support ACCESS_BACKGROUND_LOCATION Android permission. |
startLocationUpdatesAsync stopLocationUpdatesAsync hasStartedLocationUpdatesAsync | ✅ Supported | ❌ Not supported | Meta Horizon Store doesn't support ACCESS_BACKGROUND_LOCATION Android permission. |
cd expo-quest-location
yarn build
cd ../example
yarn
yarn quest # to run the app on Quest
yarn android # to run the app on Android
yarn ios # to run the app on iOS
[!NOTE] You need to prebuild the app to see changes reflected in the example app.
npm publish --access public
FAQs
A fork of expo-location that provides two implementations: The default expo-location behavior using Google Play Services. A Meta Quest-compatible implementation that does not rely on Google Play Services.
The npm package expo-quest-location receives a total of 2 weekly downloads. As such, expo-quest-location popularity was classified as not popular.
We found that expo-quest-location demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.