CVE-2026-48160

The force-push remediation creates a false sense of security. When the maintainer removed the malicious commits by force-pushing, those commit objects didn't disappear — they became dangling objects still present in every local clone, fork, and cache that was created during the window. They're accessible by SHA, and `git fsck --unreachable` will find them long after the branch looks clean on GitHub. This fundamentally changes your audit surface. The detection question isn't 'do I see the bad branch' — it's 'do I have these specific SHAs in my local object store or reflog'. Anyone who ran `git fetch --force`, checked out a specific commit, or maintains a fork created during the vulnerable window still has the poison. CI caches that built the package, developer laptops that were offline during the remediation, and any backup of the repo from that period all carry the same risk. What to do: First, identify every machine, fork, and CI environment that cloned during the window. Second, run `git fsck --unreachable` on each and search for the known-bad SHAs. Third, if found, delete the entire local repo and re-clone from a verified-clean state — don't try to cherry-pick around the bad commits, and don't force-reset to 'clean' history, which can re-pull the dangling objects back into the branch's ancestry. Fourth, audit any package registry that published versions built during the window; the contamination lives in published artifacts, not just source. The temporal window is unbounded. These dangling commits will sit in forgotten repos for years. A developer cloning a legacy fork in eighteen months won't find the branch on GitHub but will find the malicious commits if they know to look. Your response must assume the cleanup won't happen automatically — it lives in manual, per-repository audits that most organizations won't think to perform. This is the supply chain reality: the attacker's persistence advantage is structural. Git's content-addressable object store is provably impossible to scrub in-band through normal operations. Force-push tells every automated scanner the vulnerability is resolved. It doesn't tell you whether the malicious objects are sitting in your local `.git/objects` directory right now.

Reviewed through automated stages and approved by a human before publication.