CVE-2026-48161

Name of the Vulnerable Software and Affected Versions react18-use (affected versions not specified)

Description react18-use, a React 19 use hook shim, contained malicious commits in its default branch between 2026-05-19 01:07:01 and 2026-05-19 15:20:43. The issue involves the addition of src/install.js, which was integrated into the postinstall script to execute remote attacker-controlled code on developer workstations during npm install. The script fetched a JavaScript payload from an attacker-controlled HTTPS endpoint, disabled TLS verification, and evaluated the response as code. While the malicious commits were removed via force-push and the package was not published to npm, the code remains active in local clones, forks, and direct-SHA URLs. Execution was specifically designed to skip CI and cloud/serverless environments to target developer machines, potentially leading to full compromise of any resource reachable from a Node process with the user's permissions.

Recommendations For any affected checkout, clean local clones and rotate every credential the machine could reach. Audit account activity since 2026-05-19 01:07:01. Treat any developer machine that ran npm install against an affected checkout on or after 2026-05-19 01:07:01 as compromised.