Suspicious npm version 999.999.991 — empty stub "Temporary test package" published to the public registry

Hello maintainers 👋 , I wanted to point out the following suspicious situation in your NPM releases:

Summary

A version 999.999.991 of react-native-ui-lib was published to the public npm registry on 2026-09-06 at 12:30:35 UTC. It is an empty 3-file stub ("Temporary test package") with all legitimate code, dependencies, and package metadata stripped. It is currently not deprecated and remains resolvable.

latest still points to 9.1.3, but any consumer using a loose semver range (*, x, >=9.x) will resolve to 999.999.991 and get an empty module, breaking their build.

This inflated version is often used as a supply chain attack technique to hijack dependency resolution in environments that resolve to the highest available version. Also all 69,181 lines of legitimate package code have been removed and replaced with an empty stub (module.exports = {}) and The package metadata has been stripped of all author, repository, and dependency information, replaced with "Temporary test package" and UNLICENSED license.

About attribution and suggested actions

The npm registry metadata shows this version was published by the niryo account, which is on this package's official maintainer list.

This might have been an accidental test publish, either way, I suggest to verify the niryo npm account to confirm the publish was intentional and check his account for potential compromise.

Start by verifying the npm registry metadata for react-native-ui-lib version 999.999.991 and checking the niryo account attribution described in the report. Done means confirming whether the publish was intentional and documenting or escalating the account and release findings to maintainers.