CVE-2026-48159 use-reducer-async was vulnerable to malicious code execution via compromised commits

use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code o...

CVE-2026-48159 use-reducer-async was vulnerable to malicious code execution via compromised commits

use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code o...

CVE-2026-48158

use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124 that executed remote attacker-controlle...

CVE-2026-48158

use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124 that executed remote attacker-controlle...

EUVD-2026-55661

use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124 that executed remote attacker-controlle...

MAL-2026-13707 Malicious code in polymarket-stake-mathss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef71354e27f0e5798fee884366776d5b76ba0df0122148d1f4f7aeeef42b45cc Typosquat of polymarket-stake-math double s. The postinstall script install-check.cjs resolves a bundle URL from the package.json homepage field...

MAL-2026-13691 Malicious code in @rblxts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f58d29f68e2d431a9a6e55f49b0441dabb7601accfecb3c1801aabd30e29d0 @rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names 'fs','https','childprocess',...

Malicious code in simple-date-formatter-new-9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5000b7987ca50d065efc0f5a3ba7c724cb73ac0e23f54347cff8b30aa6eb5d3b package.json declares a postinstall script that opens an interactive bash reverse shell to the hardcoded remote address 124.221.154.135:4444 during n...

MAL-2026-13698 Malicious code in simple-date-formatter-new-9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5000b7987ca50d065efc0f5a3ba7c724cb73ac0e23f54347cff8b30aa6eb5d3b package.json declares a postinstall script that opens an interactive bash reverse shell to the hardcoded remote address 124.221.154.135:4444 during n...

Malicious code in simple-date-formatter-new-10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1cc0707c5a58067075648ef1c040ceeb07c2550b9f06d53b5c8c41ec167c841 [email protected] presents itself as a trivial date-formatting utility but ships two attack payloads that fire when npm installs the...

PT-2026-69885

Name of the Vulnerable Software and Affected Versions use-reducer-async affected versions not specified Description Malicious commits were introduced into the default branch of the repository, which executed remote attacker-controlled code on developer workstations during the npm install process...

PT-2026-69996

Name of the Vulnerable Software and Affected Versions react18-use affected versions not specified Description react18-use, a React 19 use hook shim, contained malicious commits in its default branch between 2026-05-19 01:07:01 and 2026-05-19 15:20:43. The issue involves the addition of...

CVE-2026-48161: Embedded Malicious Code

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

PT-2026-69970

Name of the Vulnerable Software and Affected Versions react-tracked affected versions not specified Description Malicious commits were introduced into the default branch of the repository, which execute remote attacker-controlled code on developer workstations during the npm install process. The...

PT-2026-69857

Name of the Vulnerable Software and Affected Versions use-context-selector affected versions not specified Description Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits that executed remote attacker-controlled code on developer machines during npm...

CVE-2026-48158: Embedded Malicious Code

use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124 that executed remote attacker-controlle...

MAL-2026-13664 Malicious code in titan-exchange-shared-permissions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6 [email protected] is a dependency-confusion reconnaissance package. package.json declares a postinstall script node index.js...

MAL-2026-13521 Malicious code in @rbxst/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e349df2092cb3672698c00cefa5268881f21a60d1f71394c9e223b40d086d2 scripts/postinstall.js runs at npm install time. On Windows it downloads a ZIP archive from https://files.catbox.moe/rp8idk.zip anonymous file-hostin...

Malicious code in merge-grid-stats (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1 Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook node install-cb.js executes on npm install...

Malicious code in squeez (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a953148095c35441147f1622c4810e0b946e5d120a74cfbe14f1771276a731d7 [email protected] declares a postinstall hook "postinstall": "node install.js" that runs automatically on npm install. install.js imports childprocess, f...