CVE-2024-48100: Malicious npm Commit RCE Attack Analysis

Vulnerability Overview Title: Malicious Code Execution via Tampered Commits Description: Between and , the default branch contained malicious commits that executed attacker-controlled code on developers' machines. Although these commits have been forcibly removed, local clones, forks, and direct SHA URLs may still contain them. Installing the affected commits using will execute the malicious code. Severity: Critical CVE ID: CVE-2024-48100 Impact Scope Affected Versions: 6978272a796ca02225cb747 ea69f427512c33699 949f1a3d6bb1ff7d1a0dec892 afd773e742827e8 Remediation Steps 1. Treat machines as compromised: A complete operating system reinstallation is the only reliable remediation measure. 2. Rotate all credentials: Rotate all credentials accessible from the machine, including GitHub PATs/OAuth/SSH keys, npm and other registry tokens, cloud credentials, browser sessions and saved passwords, encryption wallets, and files. 3. Audit account activity: Audit account activity around the commit, published packages, deployments, cloud API calls, and financial transactions. 4. Clean local clones: Re-clone the repository or perform a hard reset to a commit prior to . Code Snippet Timeline (UTC) T0, 2026-05-18 19:26:36: Malicious commit pushed ~T0 + 4h: Tampering detected T1, 2026-05-18 19:22:49: Commit forcibly removed Root Cause The maintainer's development machine was compromised, granting the attacker access to the maintainer's GitHub credentials. The machine has been reinstalled, and all GitHub and npm credentials have been rotated.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-48100: Malicious npm Commit RCE Attack Analysis

More from this source