CVE-2026-48159: use-reducer-async RCE Vulnerability

CVE-2026-48159 Overview

CVE-2026-48159 affects use-reducer-async, a React useReducer hook that supports asynchronous actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch of the GitHub repository contained malicious commits from da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb. These commits executed remote attacker-controlled code on developer machines during npm install. The malicious commits were removed by force-push, but local clones, forks, and direct-SHA URLs still contain them. The package was never published to npm.

Critical Impact
Any developer workstation that ran npm install against an affected checkout on or after 2026-05-18 16:29:52 should be treated as fully compromised. All credentials reachable from the machine must be rotated.

Affected Products

use-reducer-async repository default branch (commits da72edb through df07d57)
Local clones and forks of the repository from the affected window
Direct-SHA checkouts referencing the malicious commit range

Discovery Timeline

2026-05-18 - Malicious commits introduced into the default branch
2026-05-19 - Malicious commits removed by force-push
2026-08-10 - CVE-2026-48159 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-48159

Vulnerability Analysis

The attacker added a new file, src/install.js, and wired it into the postinstall script in package.json. When a developer ran npm install against a checkout of the affected commits, npm automatically executed the postinstall hook. The script fetched a JavaScript payload from an attacker-controlled HTTPS endpoint. The destination endpoint was configurable through an environment variable, giving the attacker flexibility to rotate infrastructure.

The loader disabled Transport Layer Security (TLS) certificate verification before making the outbound request. It then evaluated the response body as JavaScript with require available in scope. This granted the payload full access to the Node.js runtime and the developer's filesystem, network, and credential stores.

The loader deliberately skipped execution in continuous integration (CI) systems and cloud or serverless environments. The targeting logic focused the attack on human developer workstations, where interactive credentials, SSH keys, cloud tokens, and source code are most concentrated. The second-stage payload was hosted by the attacker and cannot be reconstructed after takedown.

Root Cause

This is an embedded malicious code vulnerability [CWE-506]. A trusted open source repository was modified to include a postinstall trojan. npm's lifecycle scripts execute arbitrary code by design, so any consumer running npm install against the poisoned tree triggered the loader without warning.

Attack Vector

The attack vector is a software supply chain compromise. Developers who cloned the repository, checked out an affected commit SHA, or installed from a fork during the window received the malicious postinstall hook. Execution occurred with the developer's local user permissions, providing access to browser sessions, cloud CLI credentials, ~/.npmrc tokens, SSH keys, and internal source code.

The malicious loader was added as src/install.js and referenced from the postinstall field of package.json. It performed an outbound HTTPS request with TLS verification disabled, then passed the response body to a dynamic evaluation function with require bound in scope. See the GitHub Security Advisory GHSA-2786-p4vj-vx8x for the referenced commit hashes and full advisory text.

Detection Methods for CVE-2026-48159

Indicators of Compromise

Presence of src/install.js in any local clone or fork of use-reducer-async
A postinstall entry in package.json referencing install.js in the same repository
Commit SHAs in the range da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb
Outbound HTTPS connections from node processes to unexpected domains during npm install
Node.js processes making network requests with TLS certificate verification disabled

Detection Strategies

Search developer workstations for src/install.js under any use-reducer-async checkout
Inspect Git reflogs and packed objects for the malicious commit SHA range, since force-push does not immediately delete objects locally
Correlate npm install execution timestamps with outbound network connections to non-registry domains
Review shell history and CI logs for clones of the affected repository between 2026-05-18 and 2026-05-19

Monitoring Recommendations

Alert on node child processes spawned by npm lifecycle scripts that initiate outbound HTTPS traffic
Monitor for anomalous access to credential stores, browser cookie databases, and SSH keys immediately following package installation
Baseline developer endpoint behavior for exfiltration patterns such as bursts of DNS resolution or uploads to unfamiliar hosts

How to Mitigate CVE-2026-48159

Immediate Actions Required

Treat any developer machine that ran npm install against an affected checkout on or after 2026-05-18 16:29:52 as compromised
Rotate every credential the machine could reach, including cloud tokens, SSH keys, npm tokens, Git credentials, and browser session cookies
Audit account activity across all reachable services since 2026-05-18 16:29:52 for unauthorized use
Delete local clones of the repository and re-clone from a clean state that excludes the malicious SHAs

Patch Information

The malicious commits were removed from the default branch by force-push. No package was published to npm, so no npm patch is required. Consumers must ensure their local checkouts, forks, and any pinned SHAs do not reference commits in the range da72edb through df07d57. Refer to the GitHub Security Advisory GHSA-2786-p4vj-vx8x for authoritative guidance.

Workarounds

Run npm install --ignore-scripts when installing untrusted or recently modified dependencies to block postinstall execution
Pin dependencies to specific commit SHAs known to be clean and verify integrity before installation
Perform dependency installation inside isolated, ephemeral containers rather than on developer workstations
Enforce egress network policies that restrict node and npm processes to the official registry and known mirrors

bash

# Configuration example: disable npm lifecycle scripts globally
npm config set ignore-scripts true

# Or per-install
npm install --ignore-scripts