use-reducer-async CVE-2026-48159

Exploitation requires the victim to (1) obtain a checkout of dai-shi/use-reducer-async containing commits da72edb..df07d57 - i.e. a clone, fork, or direct-SHA reference captured during the 2026-05-18 16:29:52 to 2026-05-19 15:26:07 UTC window - and (2) run npm install against that checkout with lifecycle/postinstall scripts enabled (the default) on an interactive developer machine. Limiting factors: the malicious package was never published to npm, so normal registry installs of a released version are NOT affected; the payload deliberately skips execution on CI and cloud/serverless environments, so those hosts are not compromised; installing with --ignore-scripts prevents the postinstall hook from firing; and reaching the second stage additionally requires outbound HTTPS to the attacker-controlled endpoint. The commits are no longer on the default branch, so a fresh clone of current HEAD is not affected.

This is a genuine, high-priority supply-chain compromise for anyone who touched an affected checkout in the exposure window, but its blast radius is narrower than the 9.3 CVSS 4.0 base score suggests. The supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) rates high confidentiality/integrity/availability impact with no user interaction, but that UI:N is questionable: exploitation requires a developer to actively obtain the poisoned commits and run npm install, so realistically user interaction is required (this analysis assesses UI:R / 4.0 UI:A). No EPSS score, no CISA KEV entry, and no public POC were provided; because the malicious version was never published to npm, the poisoning could not propagate through the registry to downstream consumers - it only affected people who cloned/forked the raw GitHub repo or referenced a direct SHA during the ~23-hour window. The force-push removed the commits from the default branch, further limiting new exposure. Net: for the small population that ran install from an affected checkout, treat as confirmed full workstation compromise; for everyone else practical risk is low. The second-stage payload was attacker-hosted and cannot be reconstructed, so exact post-exploitation behavior is unknown and should be assumed worst-case.

A developer clones or pulls use-reducer-async from GitHub (or checks out a specific SHA shared in an issue or fork) during the 2026-05-18/2026-05-19 window and runs npm install to try the library. The postinstall hook silently runs src/install.js, which fetches attacker code over HTTPS with certificate checks disabled and evaluates it with full Node privileges, skipping execution if it detects CI or serverless so only the workstation is hit. Within seconds the attacker's second-stage code runs as the developer, harvesting local credentials, SSH keys, and cloud tokens for lateral movement.