CVE-2026-48161 is a critical vulnerability in the react18-use package, a React 19 use hook shim. Malicious commits were introduced to the default branch between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, which executed remote attacker-controlled code on developer machines during `npm install`. The commits were removed, but local clones, forks, and direct-SHA URLs may still contain them. Those who ran `n [truncated]
CVE-2026-48160 was published on 2026-08-10T21:17:23.303Z and was last modified on 2026-09-09T20:55:04.493Z. The NVD entry is currently Deferred. A malicious code was added to the `react-tracked` package's default branch between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, which could execute remote attacker-controlled code on developer machines during `npm install`.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-10T18:17:49.547Z and has not been modified since then. The use-reducer-async package, a React useReducer with async actions, was compromised between 2026-05-18 16:29:52 and 2026-05-19 15:26:07. Malicious commits were added to the default branch, which executed remote attacker-controlled code on deve [truncated]
A critical vulnerability was discovered in the use-context-selector package, a React useContextSelector hook in userland. Between May 18, 2026, and May 19, 2026, malicious commits were added to the default branch, which executed remote attacker-controlled code on developer machines during `npm install`. The commits were removed, but local clones, forks, and direct-SHA URLs may still contain them. Those wh [truncated]
