A malicious post‑install script was injected into the use‑reducer‑async package between May 18 and May 19 2026. The script fetched a payload from an attacker‑controlled HTTPS endpoint, disabled TLS verification, and evaluated the response as JavaScript with filesystem access. This allowed an attacker to execute arbitrary code on any developer system that ran "npm install" against the affected source tree, effectively providing full remote code execution under the user’s privileges.

The vulnerability affects the React utility package use‑reducer‑async developed by dai‑shi. No specific version numbers are listed in the advisory, so any clone of the repository that contained the malicious commits is potentially vulnerable. Local forks or direct‑SHA clones remain at risk even after the offending commits were force‑pushed.

The attack vector is straightforward: any developer who installs the package from a repository containing the malicious commits will trigger the exploit during post‑install. Since the vulnerability is not dependent on special network conditions or elevated privileges, the EPSS score is unavailable but the CVSS rating of 9.3 indicates a high severity. The vulnerability is not listed in CISA’s KEV catalog; however, the human‑executable payload and TLS bypass represent a real‑world exploitation risk. An attacker requires only access to the local repository and the ability to run "npm install"—common in most development workflows. Once executed, the code runs with the full permissions of the Node process, providing a complete compromise of any resources reachable from the developer machine.