Active attacks exploit Metro4Shell (CVE-2025-11953) in React Native CLI to execute commands and deploy Rust malware.
Hackers are targeting developers by exploiting the critical vulnerability CVE-2025-11953 in the Metro server for React Native to deliver malicious payloads for Windows and Linux.
Previously Clawdbot and then Moltbot, this agent can take actions without you having to prompt it and make those decisions by accessing large swaths of your digital life.