The vulnerability exists in the react18-use repository, a React 19 use hook shim, where malicious commits were added between 2026‑05‑19 01:07:01 and 2026‑05‑19 15:20:43. A postinstall script in the default branch fetched a JavaScript payload from an attacker‑controlled HTTPS endpoint, disabled TLS verification, and evaluated the response as code with require. When a developer ran npm install on the affected checkout, this script executed with the Node process’s permissions, allowing the attacker to execute arbitrary code on the developer’s workstation. This results in a full compromise of the machine and any credentials or services accessible from that Node process.

The affected system is the dai‑shi:react18-use package. Any local clone, fork, or direct‑SHA checkout of the default branch during the specified timeframe contains the malicious commits. Local copies remain vulnerable after the force‑push until they are replaced with a clean version. The package was never published to npm, so the risk is limited to developers who pulled or cloned the repository and performed npm install.

The CVSS score of 9.3 indicates a severe vulnerability. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is the untrusted postinstall hook that runs automatically during npm install on a developer’s workstation. If a developer has a clone containing the malicious commits, the attacker can control the HTTPS endpoint or the injected code, leading to full control over the Node process and any resources the user can access. The exploitability is high because the malicious payload executes without any special conditions beyond a local clone and npm install.