Executive brief
use-context-selector is a React hook library distributed via GitHub. Between May 18–19, 2026, an attacker who compromised a maintainer's development machine pushed malicious commits to the default branch that executed arbitrary code on developer machines during npm install. The malicious code fetched and executed attacker-controlled JavaScript, targeting developer workstations (not CI/cloud environments) and potentially compromising all credentials and data accessible to the developer's user account.
Technical details
A postinstall hook (src/install.js) was injected into the package.json of affected commits. The hook fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (with TLS verification disabled) and executed it via Node.js require() with full access to the developer's environment and credentials. Execution was deliberately skipped on CI and cloud/serverless platforms, targeting local developer machines. The package was not published to npm, limiting exposure to developers who cloned the repository directly or pulled from forks containing the malicious commits. The second-stage payload cannot be recovered; assume full compromise of any credentials, keys, tokens, and data reachable from a Node process running with the user's permissions.
Affected products
- dai-shi use-context-selector commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124
Timeline
- 2026-05-18: other: Malicious commits pushed to default branch
- 2026-05-19: disclosed: Malicious commits removed via force-push; compromise detected ~8 hours after initial push
- 2026-05-22: advisory: GitHub Security Advisory GHSA-7h6v-mwq6-jhm8 published
- 2026-08-10: other: CVE-2026-48158 published on NVD