Critical

Malicious postinstall RCE in react18-use repository checkout

IdentifiersCVE-2026-48161CWE-506· Embedded Malicious Code

CVE-2026-48161 is a software supply-chain compromise affecting the react18-use repository rather than a published package release. During a limited window on 2026-05-19, attacker-introduced commits on the default branch added a malicious installer component and wired it into the package postinstall lifecycle so that running npm install against an affected checkout executed attacker-controlled code on the developer machine. The malicious logic retrieved a second-stage JavaScript payload from an attacker-controlled HTTPS source, disabled TLS certificate verification, and evaluated the returned code with Node.js module-loading capability available. The execution path was intentionally designed to avoid CI and cloud or serverless environments, indicating selective targeting of developer workstations. Although the malicious commits were later removed from the default branch, affected local clones, forks, and direct commit checkouts may still retain the code and remain exploitable when dependency installation is performed.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results in arbitrary remote code execution in the context of the user running npm install on an affected checkout. Because the second-stage payload was attacker-hosted and is not recoverable, the full post-exploitation scope cannot be bounded. The available information indicates that anything reachable from the Node.js process with the user's permissions should be considered compromised, including local source code, developer secrets, authentication material, cloud credentials, SSH material, browser-accessible sessions, and other resources accessible from the workstation. This can enable credential theft, persistence, lateral movement into development and production environments, source-code tampering, and broader supply-chain compromise.

Mitigation

If you can’t patch tonight, do this now.

Until clean provenance is confirmed, avoid running npm install or other package lifecycle-triggering commands against untrusted or historically affected checkouts. Disable or restrict execution of package lifecycle scripts where operationally feasible, especially for source checkouts from third-party repositories. Use isolated build or development environments with minimal credential exposure, enforce least privilege on developer workstations, and monitor for anomalous outbound network activity and credential use following package installation events. Repository consumers should validate commit history and provenance before building from source, particularly when using direct commit references or forks.

Remediation

Patch, then assume compromise.

Remove and replace any affected local clones, forks, or direct commit checkouts that may contain the malicious history. Systems on which npm install was executed against an affected checkout during or after the malicious commit window should be treated as compromised and rebuilt or otherwise remediated according to incident-response procedures. Rotate every credential, token, key, and session the machine could access; review and revoke persistent authentication where possible; and audit account and infrastructure activity beginning from 2026-05-19 01:07:01 UTC. Ensure developers obtain the repository only from a known-clean state after the malicious commits were removed, and verify repository history before reuse.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

cvefeed high severityNews

Aug 10, 2026

CVE-2026-48161 - react18-use was vulnerable to malicious code execution via compromised commits

A supply-chain compromise in the react18-use repository where malicious commits added a postinstall script that fetched and executed attacker-controlled remote code on developer machines during npm install from an affected checkout.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-48161

NVD

nvd.nist.gov/vuln/detail/CVE-2026-48161

MITRE CWE · CWE-506

Embedded Malicious Code

github.com

github.com/dai-shi/react18-use/security/advisories/GHSA-32xh-vg5f-64fm

Malicious postinstall RCE in react18-use repository checkout

IdentifiersCVE-2026-48161CWE-506· Embedded Malicious Code