
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
rn-16kb-support
Advanced tools
A CLI tool and library to detect Android native artifacts that may not support 16KB Memory Page Size in React Native projects
A CLI tool and library to detect Android native artifacts that may not support 16KB Memory Page Size in React Native projects.
Android 15 introduces support for 16KB memory page sizes, which can improve app performance but requires native libraries to be compatible. This tool helps identify potential compatibility issues in your React Native project's native dependencies.
npm install -g rn-16kb-support
# or run directly with npx
npx rn-16kb-support
npx rn-16kb-check [options] [path]
--path <projectRoot>: Project root directory (default: current working directory)--format <text|json>: Output format (default: text)--verbose: Show extra information--fail-on-issue: Exit with code 1 if any incompatibility found--detectors <list>: Comma separated detectors to run (default: 'default')# Scan current directory with text output
npx rn-16kb-check
# Scan specific project with verbose output
npx rn-16kb-check --path ./my-react-native-app --verbose
# Get JSON output for CI integration
npx rn-16kb-check --format json
# Fail CI build if issues found
npx rn-16kb-check --fail-on-issue
Text format:
Scanning project /path/to/my-app
Found 42 native artifacts, running 1 detectors
✖ warning: potential incompatibility found
- package: react-native-foo
path: node_modules/react-native-foo/android/libs/libfoo.so
artifact: so
detector: default
reason: "ELF program header alignment suggests built with 4KB assumption (alignment: 0x1000)"
docs: https://github.com/kbqdev/rn-16kb-support#how-to-fix
✔ pass: react-native-bar (node_modules/react-native-bar/android/library.aar)
JSON format:
[
{
"package": "react-native-foo",
"path": "node_modules/react-native-foo/android/libs/libfoo.so",
"artifact": "so",
"detections": [
{
"name": "default",
"ok": false,
"score": 78,
"reason": "ELF program header alignment suggests built with 4KB assumption (alignment: 0x1000)"
}
]
}
]
Scan a project for 16KB page size compatibility issues.
import { scanProject } from 'rn-16kb-support';
const results = await scanProject('/path/to/project', {
projectRoot: '/path/to/project',
detectors: ['default'],
verbose: true
});
Run the CLI programmatically.
import { runCli } from 'rn-16kb-support';
await runCli(['--path', '/my/project', '--format', 'json']);
The tool uses pluggable detectors to analyze different types of artifacts:
The default detector analyzes:
readelf if available, falls back to manual ELF header parsingThe raw-readelf detector runs configurable rules against readelf output:
npx rn-16kb-check --detectors raw-readelf
Configure rules in config/defaults.json or extend the detector class.
Create custom detectors by implementing the Detector interface:
import { Detector, DetectionResult } from 'rn-16kb-support';
class MyDetector implements Detector {
name = 'my-detector';
async run(filePath: string): Promise<DetectionResult> {
// Your detection logic here
return {
ok: true,
score: 50,
reason: 'Custom analysis result'
};
}
}
Add to your workflow to fail PRs with compatibility issues:
name: Check 16KB Page Size Compatibility
on: [push, pull_request]
jobs:
check-16kb-support:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
with:
node-version: '18'
- name: Check 16KB compatibility
run: npx rn-16kb-support --fail-on-issue
When the tool identifies potential issues:
Customize detector behavior by modifying config/defaults.json:
{
"readelfRules": {
"minSuspiciousAlignment": 4096,
"badSectionPatterns": [
".note.android.ident",
".gnu.version"
]
}
}
npm run build
npm test
npm run test:watch
npm run lint
npm run lint:fix
The tool consists of:
readelf to be availableMIT
FAQs
A CLI tool and library to detect Android native artifacts that may not support 16KB Memory Page Size in React Native projects
We found that rn-16kb-support demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.