Dependency health Workspace Solo coming soon

@react-native-aria/overlaysnpm

Documented supply-chain history

This package has dated incident reports relevant to its trust history. Check the affected releases and the response before drawing conclusions about its current version.

Read the incident coverage →

Vulnerabilities, end of life and next steps

Check a specific version for known advisories, documented mitigations and evidence-backed earlier-version options. Maintenance health is separate from vulnerability status.

Review remediation options →
What the project says about itself
  • Build provenance — the latest release carries no provenance attestation. Source: the registry.
  • Publishers on the registry — 4. Source: the registry.
  • Open milestones — @gluestack-ui/themed@next 18/18 done. Source: the repository's milestones.

Third-party facts checked 5 days ago; registry facts on every crawl.

State history 1
WhenChange
2026-11-11 first verdict: active
Supply-chain history 1

  1. account hijacked 2025-06

    A leaked maintainer token without 2FA published sixteen @react-native-aria packages and @gluestack-ui/utils with the whitespace-hidden trojan from the rand-user-agent compromise.

    All compromised versions were deprecated within two days; gluestack published an incident report and rotated tokens.

    Source: Aikido analysis and the gluestack incident report, 7 June 2025. History, not a warning about today — the verdict above is about maintenance now.

Badge

maintenance: active

Drop this in your README. It re-renders itself as the verdict changes.

[![maintenance](https://isitdeadyet.dev/badge/npm/@react-native-aria/overlays.svg)](https://isitdeadyet.dev/npm/@react-native-aria/overlays)

Watch it

Get told when @react-native-aria/overlays changes state, changes licence, or is deprecated — instead of finding out during an incident.

Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.