Use Reducer Async
Monthly
Malicious code injection into the use-reducer-async GitHub repository (a small React useReducer-with-async-actions helper by dai-shi) turned developer workstations into remote-code-execution targets during npm install. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07 UTC the default branch carried attacker-planted commits (da72edb through df07d57) that added src/install.js, wired it into the postinstall hook, fetched an attacker-hosted second-stage payload over TLS-verification-disabled HTTPS, and eval'd it with require available. The malicious version was never published to npm and the commits were force-pushed away, but any local clone, fork, or direct-SHA checkout still triggers the payload on install; there is no CISA KEV listing and no public exploit identified at time of analysis for the reconstructable payload itself.
Malicious code injection into the use-reducer-async GitHub repository (a small React useReducer-with-async-actions helper by dai-shi) turned developer workstations into remote-code-execution targets during npm install. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07 UTC the default branch carried attacker-planted commits (da72edb through df07d57) that added src/install.js, wired it into the postinstall hook, fetched an attacker-hosted second-stage payload over TLS-verification-disabled HTTPS, and eval'd it with require available. The malicious version was never published to npm and the commits were force-pushed away, but any local clone, fork, or direct-SHA checkout still triggers the payload on install; there is no CISA KEV listing and no public exploit identified at time of analysis for the reconstructable payload itself.