CVE-2026-48160: react-tracked Library RCE Vulnerability

CVE-2026-48160 Overview

CVE-2026-48160 is a supply chain compromise affecting the react-tracked GitHub repository. Between 2026-05-18 and 2026-05-19, attackers pushed malicious commits to the default branch that added a postinstall script executing remote attacker-controlled code during npm install. The commits were removed by force-push, but local clones, forks, and direct-SHA references remain affected. The malicious package was never published to npm, limiting blast radius to developers who cloned or forked the repository at the affected SHAs. The vulnerability is classified under [CWE-506] Embedded Malicious Code.

Critical Impact
Any developer machine that ran npm install against an affected checkout should be treated as fully compromised, with credential rotation and account activity audit required back to 2026-05-18 19:26:36.

Affected Products

react-tracked repository commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8
Local clones and forks pulled between 2026-05-18 19:26:36 and 2026-05-19 15:22:45
Any direct-SHA URL or archive referencing the malicious commit range

Discovery Timeline

2026-08-10 - CVE-2026-48160 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-48160

Vulnerability Analysis

The attackers added src/install.js to the repository and wired it into the postinstall lifecycle hook in package.json. When a developer runs npm install on a checkout of an affected commit, npm executes the postinstall script automatically. The script fetches a JavaScript payload from an attacker-controlled HTTPS endpoint, disables TLS certificate verification, and evaluates the fetched code with require available in scope. Execution effectively grants the attacker arbitrary code execution with the developer's operating system privileges. The endpoint URL is configurable via an environment variable, which suggests staged targeting or infrastructure rotation.

Root Cause

The root cause is trojanized source code committed directly to the default branch of a widely used open-source package. Node.js package managers execute lifecycle scripts by default, so a malicious postinstall entry runs without user prompting. The install.js payload was designed to skip execution on continuous integration runners and cloud or serverless environments, focusing the attack on developer workstations where credentials, tokens, and SSH keys are typically present.

Attack Vector

The attack vector is a cloned or forked repository at an affected commit SHA. Cloning the repository is not itself dangerous; running npm install against the checkout triggers execution. The second-stage payload was hosted on attacker infrastructure and is no longer retrievable, so the exact post-exploitation behavior cannot be reconstructed. Investigators must assume full compromise of any asset reachable from a Node.js process with the user's permissions, including cloud API tokens, git credentials, SSH keys, browser sessions, and connected internal systems. See the GitHub Security Advisory GHSA-79c5-q7m9-9c6x for the definitive technical writeup.

Detection Methods for CVE-2026-48160

Indicators of Compromise

Presence of src/install.js in a react-tracked checkout, particularly one referenced in postinstall
Local git history containing commit SHAs between 6978272a7d6ca02225cb747ea69f427512e33699 and 949f1a3d6bb1ff7d1a0dec892afd773e742627e8
Outbound HTTPS connections from node processes to non-registry hosts during npm install
Node.js processes invoking require on dynamically fetched code with TLS verification disabled

Detection Strategies

Search developer endpoints for the malicious commit SHAs in .git/logs/HEAD and reflogs of react-tracked clones
Inspect package.json and src/install.js in any local clone or fork for the postinstall payload
Correlate npm install executions with outbound network connections initiated by child node processes on or after 2026-05-18 19:26:36
Hunt for unusual credential access, cloud CLI activity, or token exfiltration originating from developer workstations in the affected window

Monitoring Recommendations

Baseline and alert on node child processes making direct HTTPS calls outside the npm registry during package installs
Monitor endpoint DNS and proxy logs for previously unseen domains contacted by developer tooling
Alert on any Node.js runtime invocation of eval, Function, or vm on fetched content combined with disabled TLS verification

How to Mitigate CVE-2026-48160

Immediate Actions Required

Treat any developer machine that ran npm install against an affected checkout on or after 2026-05-18 19:26:36 as fully compromised
Rotate every credential reachable from the affected machine, including cloud tokens, git PATs, SSH keys, and browser-stored secrets
Audit account and API activity for anomalies dating back to 2026-05-18 19:26:36
Delete and re-clone all local copies and forks of react-tracked from the current clean default branch

Patch Information

The malicious commits were removed from the default branch via force-push. There is no npm package to update because the trojanized code was never published to the registry. Users must re-clone the repository from the current clean state; existing local clones and forks retain the malicious commits in their history and working tree. Refer to the GitHub Security Advisory GHSA-79c5-q7m9-9c6x for authoritative remediation guidance.

Workarounds

Run npm install with --ignore-scripts when working with untrusted or recently modified repositories to suppress lifecycle script execution
Perform initial package installs inside ephemeral containers or virtual machines isolated from developer credentials
Pin dependency sources to the official npm registry rather than direct git or SHA references where feasible
Verify the default branch HEAD SHA against the upstream repository before running install commands on cloned projects

bash

# Disable npm lifecycle scripts globally or per-install
npm config set ignore-scripts true

# Or use the flag on a single install
npm install --ignore-scripts

# Inspect a clone for the malicious file and postinstall wiring
grep -R "postinstall" package.json
ls -la src/install.js 2>/dev/null && echo "Suspicious file present - do not run npm install"