
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
react-native-navbar-listener
Advanced tools
Detect Android navigation bar height and visibility changes in React Native / Expo Custom Build.
🧭 Prevent React Native apps from overlapping with the Android system navigation bar on some devices by listening for navigation bar height changes and notifying the JavaScript layer.
When upgrading to Expo SDK 53, some environments (for example Xiaomi HyperOS and Samsung One UI) showed an issue where bottom navigation or content overlapped the system navigation bar. Related libraries such as react-native-safe-area-context and @react-navigation/material-top-tabs have reports about similar behavior but no immediate plans to fix it. This small library provides a focused workaround by exposing navigation bar height and change events to the React Native JavaScript layer.
npm i react-native-navbar-listener
# or
npx expo install react-native-navbar-listener
import { addNavBarHeightListener, getNavBarHeight } from 'react-native-navbar-listener';
const getNavBarInitialHeight = async () => {
const navBarHeight = await getNavBarHeight();
console.log('NavBarInitialHeight:', navBarHeight);
};
const onNavBarHeightChanged = (navBarHeight: number) => {
console.log('NavBarHeightChanged:', navBarHeight);
};
useEffect(() => {
getNavBarInitialHeight();
const remover = addNavBarHeightListener(onNavBarHeightChanged);
return remover;
}, []);
NavBarHeightChanged event.getNavBarHeight().setWindowInsetsAnimationCallback() API used in this library was introduced in Android 11.setWindowInsetsAnimationCallback, only minimum and maximum values are reliably captured — intermediate animation frames may still trigger redundant events. Therefore, debouncing is recommended on the JavaScript side.import { Dimensions, Platform } from 'react-native';
import { useSafeAreaInsets } from 'react-native-safe-area-context';
import { addNavBarHeightListener, getNavBarHeight } from 'react-native-navbar-listener';
import { debounce } from 'lodash';
const IOS = Platform.OS === 'ios';
// in function component:
const insets = useSafeAreaInsets();
const basePaddingBottom = IOS ? insets.bottom : 0;
const [paddingBottom, setPaddingBottom] = useState(basePaddingBottom);
const onNavBarHeightChanged = debounce((navBarHeight: number) => {
setPaddingBottom(basePaddingBottom + (navBarHeight || (IOS ? 0 : 16)));
}, 50);
const getNavBarInitialHeight = async () => {
const navBarHeight = await getNavBarHeight();
onNavBarHeightChanged(navBarHeight);
};
useEffect(() => {
getNavBarInitialHeight();
const remover = addNavBarHeightListener(onNavBarHeightChanged);
return remover;
}, []);
return (
<Tab.Navigator style={{ height: Dimensions.get('screen').height, paddingBottom }}>
{/* your tabs */}
</Tab.Navigator>
);
Note: Depending on the device,
Dimensions.get('window').heightmay or may not include the navigation bar height. To avoid layout overlap, preferDimensions.get('screen').heightfor full-screen sizing.
getNavBarHeight(): Promise<number>Returns the current navigation bar height (in dp).
If the value is 0, the navigation bar is either hidden or the device is using gesture navigation. Some devices return 0, while others return around 16 (the height of the gesture handle area).
addNavBarHeightListener(callback: (height: number) => void): () => voidRegisters an event listener that is called when the navigation bar height changes.
Returns a function to remove the listener.
const remove = addNavBarHeightListener(h => console.log(h));
// Remove the listener
remove();
WindowInsetsAnimationCompat.Callback on Android 11 and above.WindowInsetsCompat.Type.navigationBars().DeviceEventManagerModule.RCTDeviceEventEmitter.Contributions, bug reports, and feature requests are welcome. Please open issues or pull requests on the GitHub repository.
MIT License
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.