Use Context Selector
Monthly
Supply-chain compromise of the use-context-selector React library (npm package dai-shi/use-context-selector) planted attacker-controlled malicious code that runs during `npm install`. Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34 UTC the GitHub default branch carried malicious commits (9d8481a through 6f2dae0) that added `src/install.js`, wired it into the `postinstall` hook, fetched a second-stage JavaScript payload from an attacker HTTPS endpoint with TLS verification disabled, and evaluated it with `require` available - but only on developer workstations (execution was deliberately skipped on CI and cloud/serverless). The commits were force-pushed out and the package was never published to npm, so there is no public exploit or CISA KEV entry, but any local clone, fork, or direct-SHA checkout retaining those commits will still execute the code on `npm install` today.
Supply-chain compromise of the use-context-selector React library (npm package dai-shi/use-context-selector) planted attacker-controlled malicious code that runs during `npm install`. Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34 UTC the GitHub default branch carried malicious commits (9d8481a through 6f2dae0) that added `src/install.js`, wired it into the `postinstall` hook, fetched a second-stage JavaScript payload from an attacker HTTPS endpoint with TLS verification disabled, and evaluated it with `require` available - but only on developer workstations (execution was deliberately skipped on CI and cloud/serverless). The commits were force-pushed out and the package was never published to npm, so there is no public exploit or CISA KEV entry, but any local clone, fork, or direct-SHA checkout retaining those commits will still execute the code on `npm install` today.