Loading vulnerability…
CVE-2026-48160 is a supply-chain compromise affecting the react-tracked source repository rather than the published npm package. Malicious commits were briefly present on the default branch between 2026-05-18 19:26:36 and 2026-05-19 15:22:45. Those commits added an install-time script and wired it into the package postinstall lifecycle so that running npm install against an affected checkout executed attacker-controlled code on developer machines. The implanted logic retrieved a second-stage JavaScript payload from an attacker-controlled HTTPS source, disabled TLS certificate verification, and evaluated the returned code with access to require, enabling arbitrary Node.js execution in the context of the installing user. The logic intentionally avoided execution in CI and cloud or serverless environments, indicating selective targeting of developer workstations. Although the malicious commits were later removed from the default branch by force-push and were never published to the npm registry, affected local clones, forks, and direct revision references can still contain the implant and remain dangerous.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
npm install from untrusted or unverified source checkouts, including forks and direct revision references. Restrict or disable install-time lifecycle scripts where operationally feasible, and require review of package manifest changes that introduce or modify postinstall behavior. Use reproducible, vetted source snapshots and enforce provenance controls for dependencies obtained directly from source repositories. Monitor developer environments for unexpected outbound network activity during package installation and for suspicious use of Node.js lifecycle hooks. Segregating developer credentials, minimizing workstation privilege, and limiting secret availability on development hosts can reduce blast radius, but systems that already executed the malicious install script should still be considered compromised.Patch, then assume compromise.
npm install against an affected checkout on or after 2026-05-18 19:26:36 should be treated as compromised and rebuilt or otherwise remediated according to incident response procedures. Rotate every credential, token, key, and session secret that was accessible from the affected machine, including developer, repository, cloud, CI, package publishing, and SSH credentials as applicable. Audit account and repository activity beginning 2026-05-18 19:26:36 for unauthorized access or changes. Verify dependency sources and pin to trusted clean revisions before reinstalling.No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.