React18 Use
Monthly
Software supply-chain compromise of react18-use, a small React 19 `use`-hook shim maintained by dai-shi, in which malicious commits pushed to the GitHub default branch between 2026-05-19 01:07:01 and 15:20:43 UTC added a `postinstall` script (`src/install.js`) that runs attacker-controlled remote code on developer machines during `npm install`. The malicious commits were later removed by force-push and the package was never published to npm, but local clones, forks, and direct-SHA URLs still carry them, so any `npm install` against an affected checkout still executes the payload today. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the embedded code itself constitutes working malware (CWE-506); anyone who ran `npm install` on a developer workstation on or after 2026-05-19 01:07:01 should assume full host compromise.
Software supply-chain compromise of react18-use, a small React 19 `use`-hook shim maintained by dai-shi, in which malicious commits pushed to the GitHub default branch between 2026-05-19 01:07:01 and 15:20:43 UTC added a `postinstall` script (`src/install.js`) that runs attacker-controlled remote code on developer machines during `npm install`. The malicious commits were later removed by force-push and the package was never published to npm, but local clones, forks, and direct-SHA URLs still carry them, so any `npm install` against an affected checkout still executes the payload today. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the embedded code itself constitutes working malware (CWE-506); anyone who ran `npm install` on a developer workstation on or after 2026-05-19 01:07:01 should assume full host compromise.