The vulnerability originates from a temporary addition of a post‑install script in use‑context‑selector’s repository. Between 2026‑05‑18 and 2026‑05‑19 the default branch contained malicious commits that added src/install.js, which the npm post‑install hook ran automatically. That script fetched JavaScript from an attacker‑controlled HTTPS endpoint, disabled TLS verification, and evaluated it using require, allowing an attacker to execute arbitrary code with the same permissions as the user performing npm install. The attack targets developer workstations; if executed on a developer machine, an attacker can obtain all credentials and data accessible to the Node process, essentially satisfying the criteria for remote code execution.

The affected product is the React use‑context‑selector hook provided by the vendor dai‑shi:use-context-selector. The compromise occurred in a range of commits (9d8481a5‑6f2dae05) added to the default branch during the window of May 18–19, 2026. Since the package was never published to npm, no centralized distribution channel was affected. Anyone who cloned the repository or used a direct‑SHA reference within that period, or who installed the package from a local clone after that window, is at risk. Clones that have been force‑pushed to remove the commits are not compromised, but any local or forked copy that still contains the malicious commits remains vulnerable.

The CVSS score of 9.3 reflects the severity of execution and the high impact on confidentiality, integrity, and availability of developer machines. There is no EPSS score provided, and the vulnerability is not listed in CISA KEV, indicating it has not yet been observed in the wild, but the exploitation vector is clear: a malicious post‑install script executed during npm install. If a developer uses a checkout that still includes the malicious commits, the attacker’s payload will run automatically, yielding full compromise of that machine. The attacker can also pivot to any systems or services the compromised machine can reach.