CVE-2026-48161 describes a supply chain attack in the react18-use package where malicious commits were introduced on the default branch between 2026-05-19 01:07:01 and 15:20:43. These commits added a postinstall script (src/install.js) that fetched a JavaScript payload from an attacker-controlled HTTPS endpoint with TLS verification disabled and executed it with require available. The payload was designed to run only on developer workstations, skipping CI and cloud environments. The malicious commits were removed by force-push, but local clones and forks may still contain them. The second-stage payload is unavailable, but full compromise of the affected developer machine is assumed. The package was never published to npm, limiting exposure to those who cloned the repository directly or used direct SHA URLs.

The vulnerability allows remote attacker-controlled code execution on developer machines during npm install of an affected checkout. This can lead to full compromise of the developer environment with the permissions of the user running the Node process. Credentials accessible from the compromised machine may be stolen or misused. The attack specifically targets developer workstations, avoiding CI and cloud environments, thus potentially enabling further supply chain or internal network compromise.

The malicious commits were removed by force-push, but no official patch or remediation is available since the package was not published to npm. Users who ran npm install on an affected checkout on or after 2026-05-19 01:07:01 should treat their machines as compromised. Recommended actions include rotating all credentials accessible from the machine, auditing account activity since the compromise date, and cleaning or recloning local repositories to remove the malicious commits. Avoid using direct SHA URLs or local clones that may contain the malicious commits.