A supply chain compromise in the react-tracked repository allows unauthenticated remote attackers to execute arbitrary code on developer workstations during the installation process.

This vulnerability involves embedded malicious code (CWE-506) introduced via compromised commits. The code executes automatically during the npm install process, fetching and running secondary payloads with the privileges of the local user.

Successful exploitation results in full system compromise of the developer workstation. Given the CVSS score of 9.3, this represents a critical risk, as it allows attackers to steal source code, inject further backdoors into production software, or harvest sensitive credentials and environment variables.

Immediate Action: Audit all developer machines that performed an npm install of this package on or after May 18, 2026, rotate all reachable credentials, and clean local git clones to remove the malicious commits.

Proactive Monitoring: Monitor developer workstation logs for unauthorized network connections to unknown endpoints or unexpected execution of Node.js child processes.

Compensating Controls: Implement strict egress filtering on developer networks to prevent unauthorized communication with unknown external command and control servers.

Public Exploit Available: Unknown

Organizations must treat any developer machine that utilized the affected commits as fully compromised. Immediate credential rotation and thorough forensic auditing of affected systems are required to mitigate the risk of lateral movement or supply chain contamination.