CVE-2026-48159 describes a supply chain attack on the use-reducer-async React package where malicious commits were introduced into the default branch for about one day. These commits added a postinstall script that fetched and executed a remote JavaScript payload from an attacker-controlled HTTPS endpoint with disabled TLS verification. Execution was skipped on CI and cloud environments but ran on developer machines during npm install, allowing remote attacker-controlled code execution with the user's permissions. The malicious commits were removed by force-push, but local clones and forks may still contain them. The second-stage payload is unavailable, but full compromise of affected developer machines is assumed.

Remote attacker-controlled code execution occurs on developer machines during npm install of an affected checkout, potentially leading to full compromise of anything accessible by the Node process running with the user's permissions. The malicious code bypasses TLS verification and executes arbitrary code fetched from an attacker-controlled server. This compromises developer workstations, potentially exposing credentials and sensitive data accessible from those machines.

No official patch or remediation is currently available. The malicious commits were removed from the repository by force-push, but local clones, forks, and direct-SHA checkouts may still contain the malicious code. Users who ran npm install on an affected checkout between 2026-05-18 16:29:52 and 2026-05-19 15:26:07 should treat their machines as compromised. Recommended actions include rotating all credentials accessible from the machine, auditing account activity since the compromise date, and cleaning or rebuilding local clones to remove the malicious commits. Avoid running npm install on any local copies of the repository that may contain the malicious commits.