CVE-2026-48161: Supply Chain Poisoning via Malicious npm postinstall Script

Vulnerability Summary Title: Malicious code execution via compromised commits Severity: Critical CVE ID: CVE-2026-48161 Publication Date: 2026-05-22 Package: dal-shi/react18-use (GitHub) Description: Between and , the default branch contained malicious commits that executed code controlled by remote attackers on developer machines. The commits were removed via force-push, but local clones, forks, and direct SHA URLs may still contain them, and running against the affected commits will still execute the code. This package was not published to npm. Timeline (UTC): T0, 2026-05-19 01:07:01: Malicious commits were pushed ~T0 + 0h: Tampering detected T1, 2026-05-19 15:20:43: Commits removed via force-push Summary: Between and , the default branch contained malicious commits that executed code controlled by remote attackers on developer machines. The commits were removed via force-push, but local clones, forks, and direct SHA URLs may still contain them, and running against the affected commits will still execute the code. This package was not published to npm. Severity: Critical. Arbitrary code execution as the user running . Affected Versions Affected Versions: Patched Versions: None Remediation Recommended Actions: 1. Treat the machine as compromised: A complete OS reinstallation is the only reliable remediation measure. 2. Rotate every credential accessible from the machine: GitHub PATs/OAuth/SSH keys, npm and other registry tokens, cloud credentials, browser sessions and saved passwords, crypto wallets, files. 3. Audit account activity: From the commit, published packages, deployments, cloud API calls, financial transactions. 4. Clean up local clones: Re-clone or hard-reset to a commit prior to . Root Cause: The maintainer's development machine was compromised, allowing the attacker to access the maintainer's GitHub credentials. The machine has been reinstalled, and all GitHub and npm credentials have been rotated. Code Details Indicators exists and is referenced in the script within . Unexpected outbound HTTPS requests originating from developer machines running . Specific domains and environment variable names will be added upon confirmation.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-48161: Supply Chain Poisoning via Malicious npm postinstall Script

More from this source