EUVD-2026-55836Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Payload runs automatically via postinstall (AC:L, PR:N) but only after the developer chooses to clone and install poisoned source, so UI:R; RCE with user permissions yields full C/I/A within that host (S:U).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on developer machines during npm install. The commits were removed by force-push, but local clones, forks, and direct-SHA URLs may still contain them, and npm install against an affected checkout will still execute the code today. The package was not published to npm. src/install.js was added and wired into the postinstall script. It fetched a JavaScript payload from an attacker-controlled HTTPS endpoint (configurable via an environment variable), disabled TLS verification, and evaluated the response as code with require available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations. The second-stage payload was attacker-hosted and cannot be reconstructed. Assume full compromise of anything reachable from a Node process with the user's permissions. Those who ran npm install against an affected checkout on a developer machine on or after 2026-05-18 19:26:36 should treat the machine as compromised, rotate every credential the machine could reach, audit account activity** since 2026-05-18 19:26:36, and clean local clones.
Articles & Coverage 1
AnalysisAI
Malicious code injection in the react-tracked source repository (GitHub dai-shi/react-tracked) allowed attacker-controlled remote code execution on developer machines during dependency installation. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45 UTC the default branch carried booby-trapped commits (6978272 through 949f1a3) that added a postinstall hook fetching and evaluating a second-stage payload from an attacker HTTPS endpoint. The malicious commits were force-pushed away and the package was never published to npm, so npm registry consumers are unaffected, but anyone who ran npm install against a poisoned checkout, fork, or direct-SHA clone still executes the code today. No public exploit identified at time of analysis and the flaw is not on CISA KEV, though the incident is a confirmed real compromise rather than a theoretical bug.
Technical ContextAI
react-tracked is a React state-management library that tracks state usage via JavaScript Proxies, typically pulled in as a project dependency and built with the Node.js/npm toolchain. This is not a logic flaw in the library's runtime code but a software supply-chain compromise (CWE-506, Embedded Malicious Code): a file src/install.js was added and wired into npm's postinstall lifecycle script, which npm executes automatically after dependency resolution. The stager fetched JavaScript from an attacker-controlled HTTPS URL (overridable via an environment variable), explicitly disabled TLS certificate verification, and evaluated the response with Node's require available, giving the payload full Node API access. It deliberately skipped execution on CI and cloud/serverless environments to evade automated build sandboxes and instead target interactive developer workstations. Because the second stage was hosted remotely and has since been taken down, its exact behavior cannot be reconstructed.
RemediationAI
There is no version-based patch to apply because the malicious code never reached npm; the remediation is repository hygiene and incident response. Delete and re-clone any local copy of react-tracked from the cleaned upstream default branch, and verify the working history does not contain commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8; purge any forks, mirrors, CI caches, or pinned direct-SHA references to those commits. Anyone who ran npm install against an affected checkout on a developer machine on or after 2026-05-18 19:26:36 UTC should treat that machine as fully compromised: rotate every credential the host could reach (SSH keys, cloud tokens, npm/registry tokens, browser-stored and environment secrets), audit account and access activity since 2026-05-18 19:26:36, and rebuild or thoroughly clean the workstation. As a preventive control, run installs with scripts disabled (npm install --ignore-scripts) when pulling untrusted checkouts, since that blocks the postinstall vector entirely at the cost of skipping any legitimate lifecycle scripts. Follow the vendor advisory at https://github.com/dai-shi/react-tracked/security/advisories/GHSA-79c5-q7m9-9c6x.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-506 – Embedded Malicious Code
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today