I asked Claude Code what it would take to get this on the Play Store. During that assessment it flagged the ESLint config file. Looked totally normal. Ten lines. Standard Expo boilerplate.
Except after the closing bracket on line 10, hidden behind 300 spaces on the same line, was an obfuscated remote code execution loader.
dgolman•55m ago
Except after the closing bracket on line 10, hidden behind 300 spaces on the same line, was an obfuscated remote code execution loader.