{"uuid": "733547de-3fda-40a6-8908-bc3c1b80f3ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-48161", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117073932098519347", "content": "CVE-2026-48161 | CRITICAL: dai-shi react18-use had malicious postinstall script \u2014 RCE on dev machines via npm install. Not in npm registry, but local checkouts may be compromised. Rotate creds & reimage if affected. https://radar.offseq.com/threat/cve-2026-48161-cwe-506-embedded-malicious-code-in-dai-shi-react18-use-f46bf3ec395447fd #OffSeq #SupplyChain #CVE #npm #infosec", "creation_timestamp": "2026-08-11T00:00:35.323226Z"}