React2Shell, npm Malware, and Your Vibe-Coded App

A critical remote-code-execution bug in React Server Components got a name this week: React2Shell. It reaches into Next.js, the framework behind a huge share of AI-generated apps. At the same time, a new wave of npm supply-chain malware hit developer tools, and Cursor quietly gave its agent the ability to read and write across your Google Workspace. None of these are exotic. All of them touch apps built with Lovable, Bolt, v0, Cursor, Replit, and similar tools right now.

TL;DR

• React2Shell (CVE-2025-55182) is a critical RCE in React 19's Server Components; it flows into Next.js via CVE-2025-66478.
• Vercel now blocks new deployments of vulnerable Next.js versions by default — changelog.
• A supply-chain worm nicknamed Shai-Hulud 2.0 compromised npm packages via developer account takeover, planting a malicious loader — Vercel's advisory.
• Cursor can now act across Google Workspace — read, write, send — which widens what a coding agent can touch — Cursor changelog.

React2Shell: a critical bug in the framework under your app

Most apps built with AI coding tools sit on React and, often, Next.js. React2Shell (CVE-2025-55182) is a critical-severity flaw in React Server Components: specially crafted requests can lead to remote code execution under certain conditions. Because Next.js uses React Server Components, it inherited its own advisory, CVE-2025-66478, per Vercel's bulletin.

Vercel's response was blunt: new deployments running a vulnerable Next.js version now fail to deploy automatically, on every plan, no configuration needed (changelog). You can override that with an environment variable, but you shouldn't. If your app was scaffolded by an AI builder months ago and never touched since, check your Next.js version. "It still deploys" is not the same as "it's patched."

A supply-chain worm is back, and it targets the tools you trust

Shai-Hulud 2.0 is a fresh round of the npm supply-chain attack pattern: attackers compromised developer accounts, then slipped a malicious loader into package.json for multiple packages. The loader hunts for the Bun runtime, installs quietly, and runs a hidden script (Vercel's writeup, citing HelixGuard's research).

This matters for vibe-coded apps specifically because AI builders lean hard on npm dependencies, often pulled in automatically by the agent without a human reading the diff. A compromised package doesn't announce itself. It just sits in your lockfile until something scans for it. Vercel says no Vercel environment was impacted and it's notifying a small set of affected customers directly — but that notification only covers Vercel-hosted builds, not every stack.

Cursor's agent can now touch your Google Workspace

Cursor added plugins that let its agent read, write, and act across Google Workspace (changelog). That's a real productivity upgrade — an agent that can draft docs, check calendars, or send email on your behalf. It's also a bigger blast radius. An agent with Workspace access is an agent that can leak or modify things well outside your codebase if a prompt goes wrong or a malicious instruction sneaks in through a document it reads.

This isn't a vulnerability by itself. It's a permissions expansion, and permissions expansions are exactly what you should audit before granting. Ask what scopes the plugin actually requests, and whether your agent needs write access or just read.

FAQ

How do I know if my Next.js app is affected by React2Shell?

Check your installed Next.js version against the advisory GHSA-9qr9-h5gf-34mp. If you're hosted on Vercel and running a vulnerable version, new deployments will already fail unless you've explicitly disabled the block. If you're hosted elsewhere, you need to upgrade manually — the platform won't stop you from staying exposed.

Should I worry about the Shai-Hulud npm supply chain attack if I used an AI builder?

Yes, in the sense that any app with an npm-based dependency tree inherited whatever packages your builder pulled in automatically. You likely didn't review each one. Run a dependency audit and check for packages flagged in the disclosures linked in Vercel's advisory rather than assuming it doesn't apply to you.

Is it safe to let Cursor's agent access my Google Workspace?

It depends entirely on the scopes you grant and what the agent is doing with them. Read-only access to a calendar is low risk. Write access to email or shared drives is not something to hand over without reviewing what the plugin can do first, per Cursor's own changelog.

The bottom line

Three different vendors, three different problems, one common thread: the infrastructure and tools underneath vibe-coded apps keep shifting, and AI builders don't automatically keep you current. A framework CVE, a compromised npm package, and a widened agent permission set are all things that can sit invisibly in an app you shipped weeks ago. None of them require you to be a security expert to check — they require you to check.