CVE-2026-48160 in react-tracked
Summary
by MITRE • 08/10/2026
react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on developer machines during `npm install`. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and `npm install` against an affected checkout will still execute the code today. The package was not published to npm. `src/install.js` was added and wired into the `postinstall` script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user's permissions. Those who ran `npm install` against an affected checkout on a developer machine on or after 2026-05-18 19:26:36 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity** since 2026-05-18 19:26:36, and clean local clones.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a sophisticated supply chain attack targeting the react-tracked npm package through malicious code execution during installation. The exploit leveraged a carefully crafted postinstall script that activated upon npm install operations, specifically designed to compromise developer workstations rather than production environments. The malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 introduced a backdoor mechanism that executed attacker-controlled JavaScript code directly on the victim's machine. The attack utilized a combination of proxy-based state tracking and malicious script injection to create a persistent threat vector within legitimate development workflows.
The technical implementation of this attack follows established patterns found in software supply chain compromises, particularly those targeting Node.js environments through package managers. The src/install.js file served as the initial infection vector, strategically positioned within the postinstall lifecycle hook to execute automatically during npm install operations. This approach aligns with common attack techniques documented in the MITRE ATT&CK framework under the Software Supply Chain Compromise tactic, specifically leveraging the persistence mechanisms available through legitimate package installation processes. The malicious script fetched JavaScript payloads from attacker-controlled HTTPS endpoints while deliberately disabling TLS verification, demonstrating sophisticated evasion capabilities that bypass standard security controls.
The operational impact of this vulnerability extends far beyond simple code execution, as it represents a complete compromise of developer environments where sensitive credentials and access tokens may be present. The attack specifically targeted developer machines by including logic to skip execution in CI/CD and cloud environments, indicating a clear understanding of typical deployment patterns and system architectures. This selective targeting approach demonstrates advanced threat actor methodology that prioritizes high-value targets while avoiding detection in automated systems. The second-stage payload delivery mechanism was designed to remain undetectable, with no way to reconstruct the malicious code from the repository, making forensic analysis extremely challenging.
Organizations should treat any system that executed npm install against affected commits as fully compromised, requiring immediate remediation and comprehensive security auditing. The vulnerability's persistence through local clones and direct SHA references means that even after commit removal, systems could continue executing malicious code. Security measures must include immediate credential rotation for all accounts accessible from potentially compromised machines, along with comprehensive audit trails of system activity since the attack timeframe. The incident highlights fundamental security gaps in dependency management practices and demonstrates how legitimate package repositories can be weaponized through supply chain compromises, aligning with CWE-829 categories related to inclusion of vulnerable or malicious third-party components. Recovery efforts must include complete clean-up of local development environments and implementation of additional verification mechanisms for npm package installations.