CVE-2026-48158: use-context-selector RCE Vulnerability

CVE-2026-48158 Overview

CVE-2026-48158 affects use-context-selector, a React useContextSelector hook library maintained in userland. Between 2026-05-18 and 2026-05-19, the project's default branch on GitHub contained malicious commits that executed remote attacker-controlled code on developer machines during npm install. The commits were later removed by force-push, but local clones, forks, and direct-SHA URLs still contain them. Running npm install against an affected checkout continues to execute the payload today. The malicious changes were never published to the npm registry.

Critical Impact
Any developer workstation that ran npm install against an affected checkout on or after 2026-05-18 15:57:18 must be treated as fully compromised, with all reachable credentials rotated.

Affected Products

use-context-selector repository checkouts containing commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124
Local clones and forks retaining the malicious commit range
Direct-SHA URL references pointing to affected commits

Discovery Timeline

2026-08-10 - CVE-2026-48158 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-48158

Vulnerability Analysis

The attack introduces a supply chain compromise through the source repository rather than the npm registry. A new file, src/install.js, was added to the project and wired into the postinstall script inside package.json. When a developer runs npm install against the affected checkout, npm invokes the postinstall lifecycle hook and executes the malicious file with the user's permissions. This vulnerability is categorized as embedded malicious code [CWE-506].

The payload fetches JavaScript from an attacker-controlled HTTPS endpoint whose URL is configurable through an environment variable. It disables TLS certificate verification before the fetch, then evaluates the response as code with require available in scope. The second-stage payload is attacker-hosted and cannot be reconstructed after takedown.

Root Cause

The root cause is the presence of an unreviewed postinstall hook pointing to code that performs remote code loading. Node package managers execute postinstall scripts automatically as part of dependency installation, granting attacker code the same privileges as the user running npm install. Force-pushing the branch removed the commits from the default view but did not purge them from cached clones, forks, or SHA-addressable URLs.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction beyond running npm install. The loader deliberately skips execution on continuous integration systems and cloud or serverless environments, narrowing the target set to interactive developer workstations. This targeting choice reduces detection surface while maximizing access to source code, SSH keys, cloud credentials, and browser session artifacts stored on developer machines.

The vulnerability manifests inside src/install.js, which is invoked through the postinstall script entry. See the GitHub Security Advisory for the exact commit range and file details.

Detection Methods for CVE-2026-48158

Indicators of Compromise

Presence of src/install.js in a use-context-selector checkout
A postinstall entry in package.json that invokes install.js
Git history containing any commit SHA between 9d8481a513b7b0d1c0941b220c69b25de748641b and 6f2dae054ca014068bdbbb4db96006424d674124
Outbound HTTPS connections from node processes to unfamiliar hosts during npm install
TLS verification disabled in Node processes launched during dependency installation

Detection Strategies

Grep local repositories and developer laptops for the affected commit SHAs and for src/install.js inside use-context-selector directories.
Correlate npm install process launches with child node processes making outbound HTTPS connections to non-registry hosts.
Inspect package.json files in cached clones for postinstall hooks referencing local install scripts.
Review shell history and CI logs for npm install executions against use-context-selector after 2026-05-18 15:57:18.

Monitoring Recommendations

Alert on any node child process spawned by npm that establishes HTTPS connections to unknown domains.
Monitor developer endpoints for credential access patterns following npm install events, including reads of ~/.aws, ~/.ssh, and browser cookie stores.
Audit identity provider and SaaS logs for anomalous authentication events on accounts belonging to affected developers since 2026-05-18 15:57:18.

How to Mitigate CVE-2026-48158

Immediate Actions Required

Treat any developer machine that ran npm install against an affected checkout as fully compromised and isolate it from the network.
Rotate every credential the machine could reach, including cloud API keys, SSH keys, personal access tokens, and session cookies.
Audit account activity across source control, cloud providers, and SaaS platforms for actions taken since 2026-05-18 15:57:18.
Delete local clones and forks of use-context-selector and re-clone from a clean, post-force-push state.

Patch Information

The malicious commits were removed by force-push on the upstream repository. No patched package version is required because the compromise never reached npm. Consumers must confirm that local checkouts and forks do not retain the affected commit range. Refer to the GitHub Security Advisory GHSA-7h6v-mwq6-jhm8 for authoritative guidance.

Workarounds

Run npm install with --ignore-scripts when installing from untrusted or unverified checkouts.
Pin dependencies to registry-published versions rather than Git SHAs pointing to third-party repositories.
Perform dependency installation inside disposable sandboxes or containers isolated from developer credentials.
Enforce network egress controls on developer workstations that block Node processes from reaching arbitrary HTTPS endpoints during installation.

bash

# Configuration example: disable lifecycle scripts during install
npm install --ignore-scripts

# Verify no affected commits remain in local history
git -C path/to/use-context-selector log --oneline \
  9d8481a513b7b0d1c0941b220c69b25de748641b^..6f2dae054ca014068bdbbb4db96006424d674124