Dai Shi
Monthly
Software supply-chain compromise of react18-use, a small React 19 `use`-hook shim maintained by dai-shi, in which malicious commits pushed to the GitHub default branch between 2026-05-19 01:07:01 and 15:20:43 UTC added a `postinstall` script (`src/install.js`) that runs attacker-controlled remote code on developer machines during `npm install`. The malicious commits were later removed by force-push and the package was never published to npm, but local clones, forks, and direct-SHA URLs still carry them, so any `npm install` against an affected checkout still executes the payload today. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the embedded code itself constitutes working malware (CWE-506); anyone who ran `npm install` on a developer workstation on or after 2026-05-19 01:07:01 should assume full host compromise.
Malicious code injection into the use-reducer-async GitHub repository (a small React useReducer-with-async-actions helper by dai-shi) turned developer workstations into remote-code-execution targets during npm install. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07 UTC the default branch carried attacker-planted commits (da72edb through df07d57) that added src/install.js, wired it into the postinstall hook, fetched an attacker-hosted second-stage payload over TLS-verification-disabled HTTPS, and eval'd it with require available. The malicious version was never published to npm and the commits were force-pushed away, but any local clone, fork, or direct-SHA checkout still triggers the payload on install; there is no CISA KEV listing and no public exploit identified at time of analysis for the reconstructable payload itself.
Supply-chain compromise of the use-context-selector React library (npm package dai-shi/use-context-selector) planted attacker-controlled malicious code that runs during `npm install`. Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34 UTC the GitHub default branch carried malicious commits (9d8481a through 6f2dae0) that added `src/install.js`, wired it into the `postinstall` hook, fetched a second-stage JavaScript payload from an attacker HTTPS endpoint with TLS verification disabled, and evaluated it with `require` available - but only on developer workstations (execution was deliberately skipped on CI and cloud/serverless). The commits were force-pushed out and the package was never published to npm, so there is no public exploit or CISA KEV entry, but any local clone, fork, or direct-SHA checkout retaining those commits will still execute the code on `npm install` today.
Software supply-chain compromise of react18-use, a small React 19 `use`-hook shim maintained by dai-shi, in which malicious commits pushed to the GitHub default branch between 2026-05-19 01:07:01 and 15:20:43 UTC added a `postinstall` script (`src/install.js`) that runs attacker-controlled remote code on developer machines during `npm install`. The malicious commits were later removed by force-push and the package was never published to npm, but local clones, forks, and direct-SHA URLs still carry them, so any `npm install` against an affected checkout still executes the payload today. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the embedded code itself constitutes working malware (CWE-506); anyone who ran `npm install` on a developer workstation on or after 2026-05-19 01:07:01 should assume full host compromise.
Malicious code injection into the use-reducer-async GitHub repository (a small React useReducer-with-async-actions helper by dai-shi) turned developer workstations into remote-code-execution targets during npm install. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07 UTC the default branch carried attacker-planted commits (da72edb through df07d57) that added src/install.js, wired it into the postinstall hook, fetched an attacker-hosted second-stage payload over TLS-verification-disabled HTTPS, and eval'd it with require available. The malicious version was never published to npm and the commits were force-pushed away, but any local clone, fork, or direct-SHA checkout still triggers the payload on install; there is no CISA KEV listing and no public exploit identified at time of analysis for the reconstructable payload itself.
Supply-chain compromise of the use-context-selector React library (npm package dai-shi/use-context-selector) planted attacker-controlled malicious code that runs during `npm install`. Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34 UTC the GitHub default branch carried malicious commits (9d8481a through 6f2dae0) that added `src/install.js`, wired it into the `postinstall` hook, fetched a second-stage JavaScript payload from an attacker HTTPS endpoint with TLS verification disabled, and evaluated it with `require` available - but only on developer workstations (execution was deliberately skipped on CI and cloud/serverless). The commits were force-pushed out and the package was never published to npm, so there is no public exploit or CISA KEV entry, but any local clone, fork, or direct-SHA checkout retaining those commits will still execute the code on `npm install` today.