
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
react-native-rlottie
Advanced tools
🚧 WIP, please check again later!
// TODO
yarn add react-native-rlottie
npm i react-native-rlottie
Run pod install:
npx pod-install
No additional steps for android are required, except when using the new react native architecture:
(Note: This setup is required to to the fact that the on android Autolinking doesn't work with the new architecture out of the box. This procedure will change in the future.)
android/app/build.gradle file and update the file as it follows:
defaultConfig {
...
"PROJECT_BUILD_DIR=$buildDir",
"REACT_ANDROID_DIR=$rootDir/../node_modules/react-native/ReactAndroid",
- "REACT_ANDROID_BUILD_DIR=$rootDir/../node_modules/react-native/ReactAndroid/build"
+ "REACT_ANDROID_BUILD_DIR=$rootDir/../node_modules/react-native/ReactAndroid/build",
+ "NODE_MODULES_DIR=$rootDir/../node_modules/"
cFlags "-Wall", "-Werror", "-fexceptions", "-frtti", "-DWITH_INSPECTOR=1"
cppFlags "-std=c++17"
android/app/src/main/jni/Android.mk file and update the file as it follows:
# If you wish to add a custom TurboModule or Fabric component in your app you
# will have to include the following autogenerated makefile.
# include $(GENERATED_SRC_DIR)/codegen/jni/Android.mk
+
+ # Includes the MK file for `react-native-rlottie`
+ include $(NODE_MODULES_DIR)/react-native-rlottie/android/build/generated/source/codegen/jni/Android.mk
+
include $(CLEAR_VARS)
LOCAL_SHARED_LIBRARIES setting and add the following line:
libreact_codegen_rncore \
+ libreact_codegen_rlottieview \
libreact_debug \
android/app/src/main/jni/MainComponentsRegistry.cpp file and update the file as it follows:
#include <react/renderer/components/answersolver/ComponentDescriptors.h>
+ #include <react/renderer/components/rlottieview/ComponentDescriptors.h>
#include <react/renderer/components/rncore/ComponentDescriptors.h>
sharedProviderRegistry constructor:
auto providerRegistry = CoreComponentsRegistry::sharedProviderRegistry();
// Custom Fabric Components go here. You can register custom
// components coming from your App or from 3rd party libraries here.
//
// providerRegistry->add(concreteComponentDescriptorProvider<
// AocViewerComponentDescriptor>());
+ providerRegistry->add(concreteComponentDescriptorProvider<RLottieViewComponentDescriptor>());
return providerRegistry;
}
This has full feature parity with rlottie, so check their supported features here
To develop this library use the example/. Simply install the dependencies in the root dir
with yarn and then install the dependencies in the example/.
As this library is compatible with the old and the new arch, it can be useful to check both versions during development.
In example/android/gradle.properties you can simply toggle the newArchEnabled variable.
Go into example/ios and run the following command setting RCT_NEW_ARCH_ENABLED to 1 or 0 depending on which arch you want to test:
cd ios && RCT_NEW_ARCH_ENABLED=1 pod install && cd ..
FAQs
RLottie for react native
We found that react-native-rlottie demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.