{"id":"CVE-2026-45321","revision":"1b3b8789200e41a2ab7d27a7a9a60c45","records":[{"revision":"1b3b8789200e41a2ab7d27a7a9a60c45","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-45321","aliases":[],"title":"Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys","description":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.","state":0,"publishedAt":"2026-05-12T00:12:35.452+00:00","modifiedAt":"2026-08-04T03:56:09.005+00:00","affected":[{"ecosystem":"Vendor product","name":"arktype-adapter","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"arktype-adapter\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.15\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"eslint-plugin-router","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"eslint-plugin-router\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.161.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.161.12\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"eslint-plugin-start","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"eslint-plugin-start\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.0.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0.0.7\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"history","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"history\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.161.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.161.12\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"nitro-v2-vite-plugin","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"nitro-v2-vite-plugin\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.154.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.154.15\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react-router","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"react-router\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.169.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.169.8\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react-router-devtools","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"react-router-devtools\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.19\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react-router-ssr-query","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"react-router-ssr-query\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.18\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react-start","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"react-start\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.167.68\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.167.71\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react-start-client","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"react-start-client\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.51\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.54\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react-start-rsc","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"react-start-rsc\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.0.47\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0.0.50\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react-start-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"react-start-server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.55\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.58\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"router-cli","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"router-cli\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.46\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.49\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"router-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"router-core\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.169.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.169.8\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"router-devtools","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"router-devtools\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.19\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"router-devtools-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"router-devtools-core\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.167.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.167.9\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"router-generator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"router-generator\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.45\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.48\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"router-plugin","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"router-plugin\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.167.38\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.167.41\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"router-ssr-query-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"router-ssr-query-core\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.168.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.168.6\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"router-utils","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"router-utils\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.161.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.161.14\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"outer-vite-plugin","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"outer-vite-plugin\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.53\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.56\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"solid-router","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"solid-router\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.169.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.169.8\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"solid-router-devtools","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"solid-router-devtools\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.19\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"solid-router-ssr-query","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"solid-router-ssr-query\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.18\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"solid-start","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"solid-start\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.167.65\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.167.68\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"solid-start-client","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"solid-start-client\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.50\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.53\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"solid-start-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"solid-start-server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.54\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.57\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"start-client-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"start-client-core\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.168.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.168.8\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"start-fn-stubs","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"start-fn-stubs\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.161.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.161.12\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"start-plugin-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"start-plugin-core\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.169.23\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.169.26\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"start-server-core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"start-server-core\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.167.33\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.167.36\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"start-static-server-functions","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"start-static-server-functions\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.44\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.47\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"start-storage-context","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"start-storage-context\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.38\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.41\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"valibot-adapter","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"valibot-adapter\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.15\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"virtual-file-routes","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"virtual-file-routes\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.161.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.161.13\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"vue-router","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"vue-router\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.169.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.169.8\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"vue-router-devtools","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"vue-router-devtools\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.19\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"vue-router-ssr-query","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"vue-router-ssr-query\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.18\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"vue-start","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"vue-start\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.167.61\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.167.64\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"vue-start-client","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"vue-start-client\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.46\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.49\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"vue-start-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"vue-start-server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.50\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.53\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"zod-adapter","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tanstack\",\n                    \"product\": \"zod-adapter\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.166.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"1.166.15\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6,"severity":"CRITICAL"}],"references":["https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","https://github.com/TanStack/router/issues/7383","https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45321","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-45321","identifiers":["CVE-2026-45321"]},"retained":false,"historicalAffected":[]}],"coverage":[]}