Executive brief
react18-use is a JavaScript library that provides a React 19 hook compatibility shim. Between May 19 and May 22, 2026, the library's source code repository was compromised with malicious code that automatically executed when developers installed the package via npm, allowing attackers to run arbitrary code on developer workstations. The compromise affected only direct Git clones and forks, not npm package versions, but any developer who cloned or installed from the affected Git commits risks complete machine compromise and credential theft.
Technical details
The attack involved inserting a new file, `src/install.js`, wired into the npm `postinstall` script. This script fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (with TLS verification disabled), then evaluated it with `require()` available, achieving arbitrary remote code execution (RCE) as the user running npm install. The attack specifically targeted developer workstations by skipping execution on CI/cloud environments. The root cause was compromise of a maintainer's GitHub credentials via their development machine. The second-stage payload is no longer available and cannot be reconstructed, so full compromise must be assumed for any machine that ran the install after T0 (2026-05-19 01:07:01).
Affected products
- dai-shi react18-use commits 7b79148d1495a2505f9277da295a98cf176f4496 (exact range: >= 7b79148d1495a2505f9277da295a98cf176f4496, <= 7b79148d1495a2505f9277da295a98cf176f4496)
Timeline
- 2026-05-22: disclosed: GHSA advisory published by dai-shi
- 2026-08-10: disclosed: CVE-2026-48161 published to NVD
- 2026-05-19: other: Malicious commits pushed to default branch
- 2026-05-19: other: Commits removed via force-push; local clones and forks remain compromised