{"cve":"CVE-2026-45321","nvd":{"published":"2026-05-12T01:16:46.820","modified":"2026-10-26T18:10:00.173","status":"Analyzed","description":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6},"cwes":["CWE-506"],"references":["https://github.com/TanStack/router/issues/7383","https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321"],"products":["abhishake1:supersurkhet\\/cli","abhishake1:supersurkhet\\/sdk","abhishake1:taskflow-corp\\/cli","agentworkhq:agentwork-cli","antoinebcx:ml-toolkit-ts","antoinebcx:ml-toolkit-ts\\/preprocessing","antoinebcx:ml-toolkit-ts\\/xgboost","beproduct:beproduct\\/nestjs-auth","christianalares:git-git-git","christianalares:git_branch_selector","christianalares:nextmove-mcp","christianalares:tolka\\/cli","dirigible:dirigible-ai\\/sdk","guardrailsai:guardrails_ai","kilbot:tallyui\\/components","kilbot:tallyui\\/connector-medusa","kilbot:tallyui\\/connector-shopify","kilbot:tallyui\\/connector-vendure","kilbot:tallyui\\/connector-woocommerce","kilbot:tallyui\\/core","kilbot:tallyui\\/database","kilbot:tallyui\\/pos","kilbot:tallyui\\/storage-sqlite","kilbot:tallyui\\/theme","linuxfoundation:opensearch","matheuspergoli:draftauth\\/client","matheuspergoli:draftauth\\/core","matheuspergoli:draftlab\\/auth","matheuspergoli:draftlab\\/auth-router","matheuspergoli:draftlab\\/db","matheuspergoli:simple_type-safe_actions","mesa:mesadev\\/rest","mesa:mesadev\\/saguaro","mesa:mesadev\\/sdk","mistral:mistralai","mistral:mistralai\\/mistralai","mistral:mistralai\\/mistralai-azure","mistral:mistralai\\/mistralai-gcp","multiagentcognition:cmux-agent-mcp","neilcochran:cross-stitch","neilcochran:squawk\\/airports","neilcochran:squawk\\/airspace","neilcochran:squawk\\/airspace-data","neilcochran:squawk\\/airway-data","neilcochran:squawk\\/airways","neilcochran:squawk\\/fix-data","neilcochran:squawk\\/fixes","neilcochran:squawk\\/flight-math","neilcochran:squawk\\/flightplan","neilcochran:squawk\\/geo"],"source":"nvd","synced_at":"2026-10-26T18:27:13.530666824+00:00"},"epss":{"cve":"CVE-2026-45321","score":0.03278,"percentile":0.8834,"date":"2026-10-26"},"kev":{"cve":"CVE-2026-45321","date_added":"2026-05-27","due_date":"2026-06-10","vendor":"TanStack","product":"TanStack","known_ransomware":true},"osv":[{"id":"GHSA-g7cv-rxg3-hmpx","url":"https://osv.dev/vulnerability/GHSA-g7cv-rxg3-hmpx","summary":"Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys","modified":"2026-09-10T03:51:05.608689266Z","packages":[{"ecosystem":"npm","name":"@tanstack/arktype-adapter","purl":"pkg:npm/%40tanstack/arktype-adapter","ranges":[">=1.166.12 <1.166.16"],"fixed":["1.166.16"]},{"ecosystem":"npm","name":"@tanstack/eslint-plugin-router","purl":"pkg:npm/%40tanstack/eslint-plugin-router","ranges":[">=1.161.9 <1.161.13"],"fixed":["1.161.13"]},{"ecosystem":"npm","name":"@tanstack/eslint-plugin-start","purl":"pkg:npm/%40tanstack/eslint-plugin-start","ranges":[">=0.0.4 <0.0.8"],"fixed":["0.0.8"]},{"ecosystem":"npm","name":"@tanstack/history","purl":"pkg:npm/%40tanstack/history","ranges":[">=1.161.9 <1.161.13"],"fixed":["1.161.13"]},{"ecosystem":"npm","name":"@tanstack/nitro-v2-vite-plugin","purl":"pkg:npm/%40tanstack/nitro-v2-vite-plugin","ranges":[">=1.154.12 <1.154.16"],"fixed":["1.154.16"]},{"ecosystem":"npm","name":"@tanstack/react-router","purl":"pkg:npm/%40tanstack/react-router","ranges":[">=1.169.5 <1.169.9"],"fixed":["1.169.9"]},{"ecosystem":"npm","name":"@tanstack/react-router-devtools","purl":"pkg:npm/%40tanstack/react-router-devtools","ranges":[">=1.166.16 <1.166.20"],"fixed":["1.166.20"]},{"ecosystem":"npm","name":"@tanstack/react-router-ssr-query","purl":"pkg:npm/%40tanstack/react-router-ssr-query","ranges":[">=1.166.15 <1.166.19"],"fixed":["1.166.19"]},{"ecosystem":"npm","name":"@tanstack/react-start","purl":"pkg:npm/%40tanstack/react-start","ranges":[">=1.167.68 <1.167.72"],"fixed":["1.167.72"]},{"ecosystem":"npm","name":"@tanstack/react-start-client","purl":"pkg:npm/%40tanstack/react-start-client","ranges":[">=1.166.51 <1.166.55"],"fixed":["1.166.55"]},{"ecosystem":"npm","name":"@tanstack/react-start-rsc","purl":"pkg:npm/%40tanstack/react-start-rsc","ranges":[">=0.0.47 <0.0.51"],"fixed":["0.0.51"]},{"ecosystem":"npm","name":"@tanstack/react-start-server","purl":"pkg:npm/%40tanstack/react-start-server","ranges":[">=1.166.55 <1.166.59"],"fixed":["1.166.59"]},{"ecosystem":"npm","name":"@tanstack/router-cli","purl":"pkg:npm/%40tanstack/router-cli","ranges":[">=1.166.46 <1.166.50"],"fixed":["1.166.50"]},{"ecosystem":"npm","name":"@tanstack/router-core","purl":"pkg:npm/%40tanstack/router-core","ranges":[">=1.169.5 <1.169.9"],"fixed":["1.169.9"]},{"ecosystem":"npm","name":"@tanstack/router-devtools","purl":"pkg:npm/%40tanstack/router-devtools","ranges":[">=1.166.16 <1.166.20"],"fixed":["1.166.20"]},{"ecosystem":"npm","name":"@tanstack/router-devtools-core","purl":"pkg:npm/%40tanstack/router-devtools-core","ranges":[">=1.167.6 <1.167.10"],"fixed":["1.167.10"]},{"ecosystem":"npm","name":"@tanstack/router-generator","purl":"pkg:npm/%40tanstack/router-generator","ranges":[">=1.166.45 <1.166.49"],"fixed":["1.166.49"]},{"ecosystem":"npm","name":"@tanstack/router-plugin","purl":"pkg:npm/%40tanstack/router-plugin","ranges":[">=1.167.38 <1.167.42"],"fixed":["1.167.42"]},{"ecosystem":"npm","name":"@tanstack/router-ssr-query-core","purl":"pkg:npm/%40tanstack/router-ssr-query-core","ranges":[">=1.168.3 <1.168.7"],"fixed":["1.168.7"]},{"ecosystem":"npm","name":"@tanstack/router-utils","purl":"pkg:npm/%40tanstack/router-utils","ranges":[">=1.161.11 <1.161.15"],"fixed":["1.161.15"]},{"ecosystem":"npm","name":"@tanstack/router-vite-plugin","purl":"pkg:npm/%40tanstack/router-vite-plugin","ranges":[">=1.166.53 <1.166.57"],"fixed":["1.166.57"]},{"ecosystem":"npm","name":"@tanstack/solid-router","purl":"pkg:npm/%40tanstack/solid-router","ranges":[">=1.169.5 <1.169.9"],"fixed":["1.169.9"]},{"ecosystem":"npm","name":"@tanstack/solid-router-devtools","purl":"pkg:npm/%40tanstack/solid-router-devtools","ranges":[">=1.166.16 <1.166.20"],"fixed":["1.166.20"]},{"ecosystem":"npm","name":"@tanstack/solid-router-ssr-query","purl":"pkg:npm/%40tanstack/solid-router-ssr-query","ranges":[">=1.166.15 <1.166.19"],"fixed":["1.166.19"]},{"ecosystem":"npm","name":"@tanstack/solid-start","purl":"pkg:npm/%40tanstack/solid-start","ranges":[">=1.167.65 <1.167.69"],"fixed":["1.167.69"]},{"ecosystem":"npm","name":"@tanstack/solid-start-client","purl":"pkg:npm/%40tanstack/solid-start-client","ranges":[">=1.166.50 <1.166.54"],"fixed":["1.166.54"]},{"ecosystem":"npm","name":"@tanstack/solid-start-server","purl":"pkg:npm/%40tanstack/solid-start-server","ranges":[">=1.166.54 <1.166.58"],"fixed":["1.166.58"]},{"ecosystem":"npm","name":"@tanstack/start-client-core","purl":"pkg:npm/%40tanstack/start-client-core","ranges":[">=1.168.5 <1.168.9"],"fixed":["1.168.9"]},{"ecosystem":"npm","name":"@tanstack/start-fn-stubs","purl":"pkg:npm/%40tanstack/start-fn-stubs","ranges":[">=1.161.9 <1.161.13"],"fixed":["1.161.13"]},{"ecosystem":"npm","name":"@tanstack/start-plugin-core","purl":"pkg:npm/%40tanstack/start-plugin-core","ranges":[">=1.169.23 <1.169.27"],"fixed":["1.169.27"]},{"ecosystem":"npm","name":"@tanstack/start-server-core","purl":"pkg:npm/%40tanstack/start-server-core","ranges":[">=1.167.33 <1.167.37"],"fixed":["1.167.37"]},{"ecosystem":"npm","name":"@tanstack/start-static-server-functions","purl":"pkg:npm/%40tanstack/start-static-server-functions","ranges":[">=1.166.44 <1.166.48"],"fixed":["1.166.48"]},{"ecosystem":"npm","name":"@tanstack/start-storage-context","purl":"pkg:npm/%40tanstack/start-storage-context","ranges":[">=1.166.38 <1.166.42"],"fixed":["1.166.42"]},{"ecosystem":"npm","name":"@tanstack/valibot-adapter","purl":"pkg:npm/%40tanstack/valibot-adapter","ranges":[">=1.166.12 <1.166.16"],"fixed":["1.166.16"]},{"ecosystem":"npm","name":"@tanstack/virtual-file-routes","purl":"pkg:npm/%40tanstack/virtual-file-routes","ranges":[">=1.161.10 <1.161.14"],"fixed":["1.161.14"]},{"ecosystem":"npm","name":"@tanstack/vue-router","purl":"pkg:npm/%40tanstack/vue-router","ranges":[">=1.169.5 <1.169.9"],"fixed":["1.169.9"]},{"ecosystem":"npm","name":"@tanstack/vue-router-devtools","purl":"pkg:npm/%40tanstack/vue-router-devtools","ranges":[">=1.166.16 <1.166.20"],"fixed":["1.166.20"]},{"ecosystem":"npm","name":"@tanstack/vue-router-ssr-query","purl":"pkg:npm/%40tanstack/vue-router-ssr-query","ranges":[">=1.166.15 <1.166.19"],"fixed":["1.166.19"]},{"ecosystem":"npm","name":"@tanstack/vue-start","purl":"pkg:npm/%40tanstack/vue-start","ranges":[">=1.167.61 <1.167.65"],"fixed":["1.167.65"]},{"ecosystem":"npm","name":"@tanstack/vue-start-client","purl":"pkg:npm/%40tanstack/vue-start-client","ranges":[">=1.166.46 <1.166.50"],"fixed":["1.166.50"]},{"ecosystem":"npm","name":"@tanstack/vue-start-server","purl":"pkg:npm/%40tanstack/vue-start-server","ranges":[">=1.166.50 <1.166.54"],"fixed":["1.166.54"]},{"ecosystem":"npm","name":"@tanstack/zod-adapter","purl":"pkg:npm/%40tanstack/zod-adapter","ranges":[">=1.166.12 <1.166.16"],"fixed":["1.166.16"]},{"ecosystem":"npm","name":"@tanstack/arktype-adapter","purl":"pkg:npm/%40tanstack/arktype-adapter","ranges":[">=1.166.15 <1.166.16"],"fixed":["1.166.16"]},{"ecosystem":"npm","name":"@tanstack/eslint-plugin-router","purl":"pkg:npm/%40tanstack/eslint-plugin-router","ranges":[">=1.161.12 <1.161.13"],"fixed":["1.161.13"]},{"ecosystem":"npm","name":"@tanstack/eslint-plugin-start","purl":"pkg:npm/%40tanstack/eslint-plugin-start","ranges":[">=0.0.7 <0.0.8"],"fixed":["0.0.8"]},{"ecosystem":"npm","name":"@tanstack/history","purl":"pkg:npm/%40tanstack/history","ranges":[">=1.161.12 <1.161.13"],"fixed":["1.161.13"]},{"ecosystem":"npm","name":"@tanstack/nitro-v2-vite-plugin","purl":"pkg:npm/%40tanstack/nitro-v2-vite-plugin","ranges":[">=1.154.15 <1.154.16"],"fixed":["1.154.16"]},{"ecosystem":"npm","name":"@tanstack/react-router","purl":"pkg:npm/%40tanstack/react-router","ranges":[">=1.169.8 <1.169.9"],"fixed":["1.169.9"]},{"ecosystem":"npm","name":"@tanstack/react-router-devtools","purl":"pkg:npm/%40tanstack/react-router-devtools","ranges":[">=1.166.19 <1.166.20"],"fixed":["1.166.20"]},{"ecosystem":"npm","name":"@tanstack/react-router-ssr-query","purl":"pkg:npm/%40tanstack/react-router-ssr-query","ranges":[">=1.166.18 <1.166.19"],"fixed":["1.166.19"]},{"ecosystem":"npm","name":"@tanstack/react-start","purl":"pkg:npm/%40tanstack/react-start","ranges":[">=1.167.71 <1.167.72"],"fixed":["1.167.72"]},{"ecosystem":"npm","name":"@tanstack/react-start-client","purl":"pkg:npm/%40tanstack/react-start-client","ranges":[">=1.166.54 <1.166.55"],"fixed":["1.166.55"]},{"ecosystem":"npm","name":"@tanstack/react-start-rsc","purl":"pkg:npm/%40tanstack/react-start-rsc","ranges":[">=0.0.50 <0.0.51"],"fixed":["0.0.51"]},{"ecosystem":"npm","name":"@tanstack/react-start-server","purl":"pkg:npm/%40tanstack/react-start-server","ranges":[">=1.166.58 <1.166.59"],"fixed":["1.166.59"]},{"ecosystem":"npm","name":"@tanstack/router-cli","purl":"pkg:npm/%40tanstack/router-cli","ranges":[">=1.166.49 <1.166.50"],"fixed":["1.166.50"]},{"ecosystem":"npm","name":"@tanstack/router-core","purl":"pkg:npm/%40tanstack/router-core","ranges":[">=1.169.8 <1.169.9"],"fixed":["1.169.9"]},{"ecosystem":"npm","name":"@tanstack/router-devtools","purl":"pkg:npm/%40tanstack/router-devtools","ranges":[">=1.166.19 <1.166.20"],"fixed":["1.166.20"]},{"ecosystem":"npm","name":"@tanstack/router-devtools-core","purl":"pkg:npm/%40tanstack/router-devtools-core","ranges":[">=1.167.9 <1.167.10"],"fixed":["1.167.10"]},{"ecosystem":"npm","name":"@tanstack/router-generator","purl":"pkg:npm/%40tanstack/router-generator","ranges":[">=1.166.48 <1.166.49"],"fixed":["1.166.49"]},{"ecosystem":"npm","name":"@tanstack/router-plugin","purl":"pkg:npm/%40tanstack/router-plugin","ranges":[">=1.167.41 <1.167.42"],"fixed":["1.167.42"]},{"ecosystem":"npm","name":"@tanstack/router-ssr-query-core","purl":"pkg:npm/%40tanstack/router-ssr-query-core","ranges":[">=1.168.6 <1.168.7"],"fixed":["1.168.7"]},{"ecosystem":"npm","name":"@tanstack/router-utils","purl":"pkg:npm/%40tanstack/router-utils","ranges":[">=1.161.14 <1.161.15"],"fixed":["1.161.15"]},{"ecosystem":"npm","name":"@tanstack/router-vite-plugin","purl":"pkg:npm/%40tanstack/router-vite-plugin","ranges":[">=1.166.56 <1.166.57"],"fixed":["1.166.57"]},{"ecosystem":"npm","name":"@tanstack/solid-router","purl":"pkg:npm/%40tanstack/solid-router","ranges":[">=1.169.8 <1.169.9"],"fixed":["1.169.9"]},{"ecosystem":"npm","name":"@tanstack/solid-router-devtools","purl":"pkg:npm/%40tanstack/solid-router-devtools","ranges":[">=1.166.19 <1.166.20"],"fixed":["1.166.20"]},{"ecosystem":"npm","name":"@tanstack/solid-router-ssr-query","purl":"pkg:npm/%40tanstack/solid-router-ssr-query","ranges":[">=1.166.18 <1.166.19"],"fixed":["1.166.19"]},{"ecosystem":"npm","name":"@tanstack/solid-start","purl":"pkg:npm/%40tanstack/solid-start","ranges":[">=1.167.68 <1.167.69"],"fixed":["1.167.69"]},{"ecosystem":"npm","name":"@tanstack/solid-start-client","purl":"pkg:npm/%40tanstack/solid-start-client","ranges":[">=1.166.53 <1.166.54"],"fixed":["1.166.54"]},{"ecosystem":"npm","name":"@tanstack/solid-start-server","purl":"pkg:npm/%40tanstack/solid-start-server","ranges":[">=1.166.57 <1.166.58"],"fixed":["1.166.58"]},{"ecosystem":"npm","name":"@tanstack/start-client-core","purl":"pkg:npm/%40tanstack/start-client-core","ranges":[">=1.168.8 <1.168.9"],"fixed":["1.168.9"]},{"ecosystem":"npm","name":"@tanstack/start-fn-stubs","purl":"pkg:npm/%40tanstack/start-fn-stubs","ranges":[">=1.161.12 <1.161.13"],"fixed":["1.161.13"]},{"ecosystem":"npm","name":"@tanstack/start-plugin-core","purl":"pkg:npm/%40tanstack/start-plugin-core","ranges":[">=1.169.26 <1.169.27"],"fixed":["1.169.27"]},{"ecosystem":"npm","name":"@tanstack/start-server-core","purl":"pkg:npm/%40tanstack/start-server-core","ranges":[">=1.167.36 <1.167.37"],"fixed":["1.167.37"]},{"ecosystem":"npm","name":"@tanstack/start-static-server-functions","purl":"pkg:npm/%40tanstack/start-static-server-functions","ranges":[">=1.166.47 <1.166.48"],"fixed":["1.166.48"]},{"ecosystem":"npm","name":"@tanstack/start-storage-context","purl":"pkg:npm/%40tanstack/start-storage-context","ranges":[">=1.166.41 <1.166.42"],"fixed":["1.166.42"]},{"ecosystem":"npm","name":"@tanstack/valibot-adapter","purl":"pkg:npm/%40tanstack/valibot-adapter","ranges":[">=1.166.15 <1.166.16"],"fixed":["1.166.16"]},{"ecosystem":"npm","name":"@tanstack/virtual-file-routes","purl":"pkg:npm/%40tanstack/virtual-file-routes","ranges":[">=1.161.13 <1.161.14"],"fixed":["1.161.14"]},{"ecosystem":"npm","name":"@tanstack/vue-router","purl":"pkg:npm/%40tanstack/vue-router","ranges":[">=1.169.8 <1.169.9"],"fixed":["1.169.9"]},{"ecosystem":"npm","name":"@tanstack/vue-router-devtools","purl":"pkg:npm/%40tanstack/vue-router-devtools","ranges":[">=1.166.19 <1.166.20"],"fixed":["1.166.20"]},{"ecosystem":"npm","name":"@tanstack/vue-router-ssr-query","purl":"pkg:npm/%40tanstack/vue-router-ssr-query","ranges":[">=1.166.18 <1.166.19"],"fixed":["1.166.19"]},{"ecosystem":"npm","name":"@tanstack/vue-start","purl":"pkg:npm/%40tanstack/vue-start","ranges":[">=1.167.64 <1.167.65"],"fixed":["1.167.65"]},{"ecosystem":"npm","name":"@tanstack/vue-start-client","purl":"pkg:npm/%40tanstack/vue-start-client","ranges":[">=1.166.49 <1.166.50"],"fixed":["1.166.50"]},{"ecosystem":"npm","name":"@tanstack/vue-start-server","purl":"pkg:npm/%40tanstack/vue-start-server","ranges":[">=1.166.53 <1.166.54"],"fixed":["1.166.54"]},{"ecosystem":"npm","name":"@tanstack/zod-adapter","purl":"pkg:npm/%40tanstack/zod-adapter","ranges":[">=1.166.15 <1.166.16"],"fixed":["1.166.16"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}