CVE-2026-48161

CVE-2026-48161 targets react18-use via a repository-only compromise that never reached npm. The malicious commit (SHA 7b79148d1495a2505f9277da295a98cf176f4496) was force-pushed from origin after approximately 14 hours, which means standard supply chain monitoring tools — Socket.dev, registry scanning, SBOM tooling — would not detect it. The attack vector was the maintainer's GitHub account, allowing the attacker to sign the commit with a legitimate key, bypassing git's trust model entirely. Your detection options are severely limited. The only reliable indicator is analyzing local git reflog for commits within the 14-hour window, but reflog is local-only and disabled by default in shallow clones (`--depth=1`). If you cloned react18-use during that window and use shallow clones or have since deleted and re-cloned, you cannot reconstruct your exposure. Assume compromise if you cloned this package between the malicious commit's introduction and the force-push. The postinstall hook likely executed during `npm install`, and the payload may have exfiltrated credentials, established persistence, or simply waited dormant. Even if you don't recall the clone, check archived project directories and old node_modules folders — the code persists wherever it was installed. Your response: assume the development environment is compromised, rotate all credentials accessible from that machine (especially GitHub, cloud provider, and npm tokens), and treat any system that developer authenticated to after the incident as potentially exposed. There is no patch for this vulnerability — only containment of the blast radius.

Reviewed through automated stages and approved by a human before publication.