Between 2026‑05‑18 and 2026‑05‑19, the react‑tracked repository contained commits that added a postinstall script. That script fetched attacker‑controlled JavaScript from a configurable HTTPS endpoint, disabled TLS verification, and evaluated the payload with Node’s require function. When a developer ran "npm install" on a checkout containing those commits, arbitrary code executed with the user’s permissions, allowing full compromise of the machine and all systems reachable from the Node process. The flaw is a classic malicious commit attack and is categorized as CWE‑506.

The vulnerability affects the dai‑shi react‑tracked project. All clones, forks, or local copies that include the malicious commits (from SHA 6978272a7d6ca02225cb747ea69f427512e33699 to 949f1a3d6bb1ff7d1a0dec892afd773e742627e8) are susceptible. No specific version numbers are listed, but the default branch during the cited dates contained the exploit. Users who installed from the affected source, especially on developer workstations, are at risk.

The CVSS score of 9.3 marks this vulnerability as critical. Because the EPSS score is not available, the historical exploitation probability is unknown, but the nature of the attack—remote code execution via npm install—makes it highly actionable. The issue is not listed in the CISA KEV catalog, yet it remains a serious threat due to the lack of an official patch and the simplicity of executing the payload during package installation. Attackers can target any developer who pulls the compromised branch, and the damage can propagate to all resources the attacker can reach from the compromised Node process.