CVE-2026-48160

Name of the Vulnerable Software and Affected Versions react-tracked (affected versions not specified)

Description Malicious commits were introduced into the default branch of the repository, which execute remote attacker-controlled code on developer workstations during the npm install process. The attack utilizes a postinstall script linked to src/install.js that fetches a JavaScript payload from an attacker-controlled HTTPS endpoint, disables TLS verification, and evaluates the response as code. The execution is specifically designed to target developer machines, skipping CI and cloud or serverless environments. This can lead to a full compromise of any resource reachable from a Node process with the user's permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Rotate every credential reachable from the affected machine. Audit account activity since 2026-05-18. Clean all local clones, forks, and direct-SHA URLs of the repository.