Critical

Malicious postinstall RCE in use-reducer-async default branch

IdentifiersCVE-2026-48159CWE-506· Embedded Malicious Code

CVE-2026-48159 is a software supply-chain compromise affecting the default branch of the use-reducer-async React library during a limited time window. Malicious commits introduced a post-installation execution path by adding install logic and wiring it into the package postinstall lifecycle, causing attacker-controlled JavaScript to be retrieved and executed when npm install was run against an affected source checkout. The install logic disabled TLS certificate verification, fetched a second-stage payload from an attacker-controlled HTTPS source that could be selected via environment variable, and evaluated the returned code with Node.js module loading capabilities available. The malicious logic was designed to avoid execution in CI and cloud or serverless environments, indicating deliberate targeting of developer workstations. The package was not published to the npm registry, but affected local clones, forks, and direct commit-based checkouts can still contain the malicious code even after its removal from the default branch history by force-push.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results in remote code execution on the developer machine in the security context of the user running npm install. Because the second-stage payload was attacker-hosted and is not reconstructable, the full scope of post-exploitation behavior is unknown and should be treated as unrestricted compromise of anything accessible to the Node.js process under that user's permissions. This can include theft of developer credentials, source code access, tampering with local repositories, persistence, lateral movement through accessible services, and compromise of downstream environments reachable from the workstation.

Mitigation

If you can’t patch tonight, do this now.

Avoid running npm install against untrusted or historically affected source checkouts. Verify repository history and pin to known-good commits before dependency installation. Disable or tightly control execution of package lifecycle scripts where operationally feasible, especially on developer workstations. Use isolated development environments with minimal credential exposure, enforce least privilege for developer machines, and monitor for anomalous package-install behavior such as unexpected network retrieval and dynamic code evaluation during install steps. Repository consumers should also validate that forks and mirrors do not retain the malicious history.

Remediation

Patch, then assume compromise.

Remove and replace any affected local clones, forks, or direct-SHA checkouts that may still contain the malicious commits. Rebuild affected workstations from a known-good state or otherwise perform full incident-response-grade eradication, because the second-stage payload cannot be reconstructed and compromise scope cannot be bounded reliably. Rotate all credentials, tokens, keys, and secrets that were accessible from the affected machine, review account and repository activity beginning from the start of the exposure window, and validate the integrity of code and artifacts that may have been handled on the compromised system. Ensure future checkouts use a known-clean revision outside the malicious commit window.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cvefeed high severityNews

Aug 10, 2026

CVE-2026-48159 - use-reducer-async was vulnerable to malicious code execution via compromised commits

A supply-chain compromise tracked as CVE-2026-48159 in which malicious commits were inserted into the use-reducer-async repository, causing remote attacker-controlled code execution on developer machines during npm install from affected source checkouts.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-48159

NVD

nvd.nist.gov/vuln/detail/CVE-2026-48159

MITRE CWE · CWE-506

Embedded Malicious Code

github.com

github.com/dai-shi/use-reducer-async/security/advisories/GHSA-2786-p4vj-vx8x

Malicious postinstall RCE in use-reducer-async default branch

IdentifiersCVE-2026-48159CWE-506· Embedded Malicious Code