Critical

Malicious postinstall RCE in use-context-selector

IdentifiersCVE-2026-48158CWE-506· Embedded Malicious Code

CVE-2026-48158 is a software supply-chain compromise affecting the default branch of the use-context-selector project during a limited time window in May 2026. Malicious commits introduced a postinstall execution path that caused npm install against an affected source checkout to run attacker-controlled code on developer workstations. The implanted logic added an install script that retrieved a second-stage JavaScript payload from an attacker-controlled HTTPS source, disabled TLS certificate verification, and evaluated the returned code with Node.js module loading capabilities available. The malicious logic was designed to avoid execution in CI and cloud or serverless environments, indicating deliberate targeting of interactive developer systems. Although the malicious commits were later removed from the default branch, affected local clones, forks, and direct commit-based checkouts can still contain the implant and remain dangerous if dependency installation is performed. The package was not published to the npm registry.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results in arbitrary remote code execution in the context of the user running npm install on an affected checkout. Because the second-stage payload was attacker-hosted and is not recoverable, the practical impact must be treated as full compromise of the developer machine and any assets reachable with that user’s permissions from the Node.js process. This can include theft of source code, credentials, tokens, SSH material, cloud access, browser-stored secrets, and other local or network-accessible data, as well as installation of persistence or follow-on tooling. The selective avoidance of CI and cloud environments suggests the attack was optimized for compromising developer endpoints rather than build infrastructure.

Mitigation

If you can’t patch tonight, do this now.

Until clean source provenance is confirmed, avoid running npm install or any lifecycle scripts against historical or untrusted checkouts of the project. Disable or restrict execution of package lifecycle scripts where operationally feasible, especially for source-based evaluations of third-party repositories. Enforce repository integrity verification, pin to trusted release artifacts rather than mutable branch heads, and monitor for unexpected install-time script additions in dependency reviews. Developer workstations should use least-privilege access, segmented credentials, and secret isolation to reduce blast radius from install-time code execution.

Remediation

Patch, then assume compromise.

Remove and replace any affected local clones, forks, or source checkouts that may still contain the malicious commits. Re-clone only from a known-clean repository state. Any system on which npm install was executed against an affected checkout during or after the exposure window should be treated as compromised and rebuilt or otherwise remediated according to incident-response standards for full workstation compromise. Rotate all credentials, tokens, keys, and secrets that were accessible from the affected machine, and review account and infrastructure activity beginning from the start of the exposure period. Validate repository history and dependency installation scripts before restoring developer workflows.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cvefeed high severityNews

Aug 10, 2026

CVE-2026-48158 - use-context-selector was vulnerable to malicious code execution via compromised commits

A supply-chain compromise in the use-context-selector project where malicious commits added a postinstall script that fetched and executed attacker-controlled remote code on developer machines during npm install from affected source checkouts.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-48158

NVD

nvd.nist.gov/vuln/detail/CVE-2026-48158

MITRE CWE · CWE-506

Embedded Malicious Code

github.com

github.com/dai-shi/use-context-selector/security/advisories/GHSA-7h6v-mwq6-jhm8

Malicious postinstall RCE in use-context-selector

IdentifiersCVE-2026-48158CWE-506· Embedded Malicious Code