Threats Tagged 'cve-2026-48159'

The use-reducer-async React package contained malicious commits in its default branch between 2026-05-18 and 2026-05-19 that executed attacker-controlled code during npm install on developer machines. The malicious code fetched and executed a remote payload, disabling TLS verification and targeting developer workstations while skipping CI and cloud environments. The commits were removed by force-push, but local clones and forks may still contain the malicious code. The package was not published to npm. Machines that ran npm install on an affected checkout during this period should be considered compromised and require credential rotation and auditing.