Cleartext Storage of Sensitive Information

[ashishzopeCG]

Link: https://security.snyk.io/vuln/SNYK-JS-REACTNATIVEKEYS-10674028

[github-actions]

👋 @ashishzopeCG
Thanks for opening your issue here! If you find this package useful hit the star🌟!

[ashishzopeCG]

@numandev1 Any updates on this Snyk issue.

[dougg0k]

I didnt test, but @ngocle2497 seem to have provided a fix for the other flaw. So, both might be fixed.

[ashishzopeCG]

@dougg0k This snyk issue is with latest version which includes fixes provided by @ngocle2497 , seems to be not getting fixed by it.

[dougg0k]

there is a breaking bug in latest rn version, unrelated to this issue, but that report seems to be related to the version .11, not .12.

[ashishzopeCG]

@dougg0k added new screenshot with version details.

[dougg0k]

Hm, all the references mentioned in the url seems to have been for the other issue which had seemingly different flaws. Same for the CVE.

Perhaps @ngocle2497 only increased the difficulty not necessarily fixed anything. If it's even fixable.

[ngocle2497]

the pure base64 in this library? everything has been converted to bit form. i don't know which part of this library snyk is referring to