CVE-2026-48160 describes a supply chain attack in the react-tracked repository where malicious commits were introduced into the default branch for less than a day. These commits added a postinstall script that fetched and executed remote attacker-controlled JavaScript code with disabled TLS verification, allowing remote code execution on developer machines during npm install. The attack was designed to avoid execution in CI and cloud environments, focusing on developer workstations. Although the malicious commits were removed by force-push, local clones, forks, and direct SHA references may still contain the malicious code. The second-stage payload is unavailable, but full compromise of the affected machine is assumed. The package was never published to npm, limiting exposure to those who installed from the compromised repository.

Successful exploitation results in remote code execution on developer machines with the permissions of the user running npm install. This can lead to full compromise of the developer environment, including access to credentials and other sensitive data accessible to Node processes. Since the malicious code disables TLS verification and executes attacker-hosted payloads, it can bypass typical network security controls. The attack specifically targets developer workstations, potentially compromising development environments and any credentials or systems accessible from them.

The malicious commits were removed by force-push, but no official patch or remediation is provided. Users who ran npm install against the affected repository between 2026-05-18 19:26:36 and 2026-05-19 15:22:45 on developer machines should treat those machines as compromised. Recommended actions include rotating all credentials accessible from the compromised machine, auditing account activity since the compromise date, and cleaning or rebuilding local clones and forks of the repository. Since the package was not published to npm, avoid installing react-tracked from untrusted sources or direct SHAs. Monitor for any suspicious activity related to this compromise.