CVE-2026-48161: react18-use RCE Vulnerability

CVE-2026-48161 Overview

CVE-2026-48161 is a supply chain compromise affecting the react18-use repository, a React 19 use hook shim maintained on GitHub. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43 UTC, the default branch contained malicious commits that executed attacker-controlled remote code during npm install. Although the commits were removed via force-push and the package was never published to npm, local clones, forks, and direct-SHA URLs still carry the payload. Any npm install against an affected checkout will still execute the code today. The issue is tracked under [CWE-506: Embedded Malicious Code].

Critical Impact
Any developer machine that ran npm install against an affected checkout must be treated as fully compromised, with all reachable credentials rotated.

Affected Products

react18-use GitHub repository (dai-shi/react18-use)
Local clones and forks retaining commit 7b79148d1495a2505f9277da295a98cf176f4496
Any checkout containing src/install.js wired to the postinstall script

Discovery Timeline

2026-08-10 - CVE-2026-48161 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-48161

Vulnerability Analysis

The attacker introduced a src/install.js file and wired it into the postinstall lifecycle hook of the repository's package.json. When a developer runs npm install against an affected checkout, npm executes the postinstall script automatically. The script fetches a JavaScript payload from an attacker-controlled HTTPS endpoint, configurable through an environment variable. It disables TLS certificate verification before the fetch, then evaluates the response as code with require available in scope. The second-stage payload was hosted externally and cannot be reconstructed from the removed commits.

Execution runs with the developer's user permissions and full Node.js capabilities. The compromise scope includes any file, credential store, SSH key, cloud token, or network resource reachable from that user context.

Root Cause

The root cause is deliberate insertion of malicious code into the repository's default branch by an unauthorized party. The postinstall hook is a normal npm feature, but it grants arbitrary code execution to any package or repository during installation. The malicious commits were later removed by force-push, but Git's distributed model means the objects persist in existing clones, forks, and any URL referencing the commit SHA directly.

Attack Vector

The payload contains logic to skip execution on continuous integration systems and cloud or serverless environments. This targeting isolates developer workstations, which typically hold long-lived credentials for source control, cloud providers, and package registries. Because TLS verification is disabled, network defenders cannot rely on certificate pinning to block the second-stage fetch. The attacker-controlled endpoint address is configurable through an environment variable, providing flexibility for staged delivery.

Detection Methods for CVE-2026-48161

Indicators of Compromise

Presence of the file src/install.js in any local checkout or fork of dai-shi/react18-use
Git commit SHA 7b79148d1495a2505f9277da295a98cf176f4496 in local reflog or fork history
postinstall entry in package.json referencing install.js on the affected commit
Outbound HTTPS connections from node processes to non-standard endpoints during npm install

Detection Strategies

Search developer endpoints and build hosts for the malicious commit SHA across all Git repositories
Inspect ~/.npm/_logs/ and shell history for npm install invocations targeting react18-use on or after 2026-05-19 01:07:01 UTC
Alert on Node.js child processes spawning during npm install that initiate outbound network connections with TLS verification disabled

Monitoring Recommendations

Correlate developer workstation telemetry with authentication events for source control, cloud, and registry accounts since 2026-05-19 01:07:01 UTC
Monitor for anomalous use of long-lived tokens, SSH keys, and cloud credentials issued to developer accounts
Audit git object stores on build agents and CI runners for the malicious commit SHA even if the default branch was rewritten

How to Mitigate CVE-2026-48161

Immediate Actions Required

Treat any developer machine that ran npm install against an affected checkout on or after 2026-05-19 01:07:01 UTC as fully compromised
Rotate every credential reachable from the affected user context, including cloud tokens, SSH keys, npm tokens, and browser session cookies
Audit account activity across source control, cloud, and SaaS platforms for the compromise window
Delete local clones and forks containing the malicious commit and re-clone from a known-clean state

Patch Information

No package version fix applies because the code was never published to npm. The malicious commits were removed by force-push on the upstream repository. Consumers must clean local clones and forks manually. Refer to the GitHub Security Advisory GHSA-32xh-vg5f-64fm for authoritative guidance.

Workarounds

Run npm install with --ignore-scripts to suppress lifecycle hooks when working with untrusted checkouts
Pin dependencies to specific verified commit SHAs known to precede 2026-05-19 01:07:01 UTC
Isolate dependency installation inside ephemeral containers with restricted network egress and no access to production credentials
Remove any local branches, tags, or reflog entries referencing commit 7b79148d1495a2505f9277da295a98cf176f4496

bash

# Install without executing lifecycle scripts
npm install --ignore-scripts

# Verify no malicious commit exists in local repository
git log --all --oneline | grep 7b79148d1495a2505f9277da295a98cf176f4496

# Force cleanup of a compromised local clone
cd .. && rm -rf react18-use && git clone <trusted-fork-url>