Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch of the use-context-selector package contained malicious commits that executed remote attacker-controlled code during npm install on developer machines. The malicious code was added in src/install.js and triggered via a postinstall script, fetching a JavaScript payload from an attacker-controlled HTTPS endpoint with TLS verification disabled. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The package was not published to npm, but local clones, forks, or direct-SHA checkouts still contain the malicious code. The second-stage payload cannot be reconstructed. This results in full compromise of anything accessible by the Node process running with the user's permissions.

The vulnerability allows remote attacker-controlled code execution on developer machines during npm install of an affected checkout. This leads to full compromise of the developer environment with the permissions of the user running Node. Credentials accessible from the compromised machine may be stolen or misused. The malicious commits were removed from the repository by force-push, but local clones and forks remain vulnerable. The package was not published to npm, limiting exposure to those who pulled the affected commits directly.

No official patch or remediation is documented. The malicious commits were removed from the repository by force-push. Users who ran npm install on an affected checkout between 2026-05-18 15:57:18 and 2026-05-19 15:24:34 should treat their machines as compromised. Recommended actions include rotating all credentials accessible from the machine, auditing account activity since the compromise date, and cleaning or deleting local clones and forks containing the malicious commits. Avoid running npm install on any checkout containing the affected commits.