Malicious Code Execution in React 19 Shim Affects Developers

CVE-2026-48161

What is CVE-2026-48161?

A security issue was identified in the React 19 hook shim 'react18-use', where malicious commits were introduced to the default branch between May 19, 2026. These commits included code capable of executing arbitrary commands on developer machines running 'npm install'. Specifically, the compromised script fetched attacker-controlled JavaScript payloads, disabled TLS verification, and evaluated code with 'require' access, thus allowing full control over the machine's Node process. While the malicious commits were removed after a force-push, any affected local clones or forks may still harbor the malicious code. It is advised that any developers who executed 'npm install' against these affected checkouts on or after the specified date consider their machines compromised, rotate credentials, audit account activities, and clean local clones to safeguard against potential intrusions.

References