Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

Exploitation

Confirmed: listed in the CISA Known Exploited Vulnerabilities catalog.

CVSS

9.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

• CVE-2026-45321: 3.28% estimated exploitation activity in the next 30 days; percentile 88.44 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/ packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pullrequesttarget "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart. Impact A user installing any affected version executes a payload (~2.3 MB obfuscated routerinit.js) at install time that: - Harvests credentials from common locations: - AWS instance metadata (IMDS) and Secrets Manager - GCP metadata service - Kubernetes…

Published by the source

12 May 2026, 00:12 UTC

Last modified by the source

10 Sep 2026, 03:51 UTC

Source last checked

26 Oct 2026, 12:53 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-g7cv-rxg3-hmpx

2. Revision 2 · amended · 24 Oct 2026

   Amended from osv record GHSA-g7cv-rxg3-hmpx

3. Revision 1 · created · 23 Oct 2026

   Published from ghsa record GHSA-g7cv-rxg3-hmpx

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-45321

Advisory: Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
IDs: CVE-2026-45321, GHSA-g7cv-rxg3-hmpx
Record: https://patchnext.com/advisories/cve-2026-45321 (revision 3, source checked 26 Oct 2026, 12:53 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.6)
Exploitation: confirmed: listed in the CISA Known Exploited Vulnerabilities catalog.
Vendor response: Vendor fix available; fixed versions by package: @tanstack/start-storage-context 1.166.42; @tanstack/solid-router 1.169.9; @tanstack/start-static-server-functions 1.166.48; @tanstack/start-server-core 1.167.37; @tanstack/react-router-ssr-query 1.166.19; @tanstack/eslint-plugin-start 0.0.8; @tanstack/start-plugin-core 1.169.27; @tanstack/valibot-adapter 1.166.16; @tanstack/vue-start 1.167.65; @tanstack/react-router-devtools 1.166.20; @tanstack/start-fn-stubs 1.161.13; @tanstack/vue-router-ssr-query 1.166.19; @tanstack/router-devtools 1.166.20; @tanstack/solid-router-devtools 1.166.20; @tanstack/router-cli 1.166.50; @tanstack/vue-router 1.169.9; @tanstack/router-generator 1.166.49; @tanstack/react-start-rsc 0.0.51; @tanstack/react-start-client 1.166.55; @tanstack/vue-start-server 1.166.54; @tanstack/eslint-plugin-router 1.161.13; @tanstack/nitro-v2-vite-plugin 1.154.16; @tanstack/virtual-file-routes 1.161.14; @tanstack/vue-start-client 1.166.50; @tanstack/arktype-adapter 1.166.16; @tanstack/solid-start 1.167.69; @tanstack/router-core 1.169.9; @tanstack/react-router 1.169.9; @tanstack/history 1.161.13; @tanstack/react-start 1.167.72; @tanstack/router-ssr-query-core 1.168.7; @tanstack/start-client-core 1.168.9; @tanstack/solid-router-ssr-query 1.166.19; @tanstack/router-utils 1.161.15; @tanstack/router-plugin 1.167.42; @tanstack/router-devtools-core 1.167.10; @tanstack/solid-start-client 1.166.54; @tanstack/router-vite-plugin 1.166.57; @tanstack/react-start-server 1.166.59; @tanstack/zod-adapter 1.166.16; @tanstack/solid-start-server 1.166.58; @tanstack/vue-router-devtools 1.166.20. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm @tanstack/start-storage-context: affected >= 1.166.38, <= 1.166.38; >= 1.166.41, <= 1.166.41; fixed in 1.166.42
- npm @tanstack/solid-router: affected >= 1.169.5, <= 1.169.5; >= 1.169.8, <= 1.169.8; fixed in 1.169.9
- npm @tanstack/start-static-server-functions: affected >= 1.166.44, <= 1.166.44; >= 1.166.47, <= 1.166.47; fixed in 1.166.48
- npm @tanstack/start-server-core: affected >= 1.167.33, <= 1.167.33; >= 1.167.36, <= 1.167.36; fixed in 1.167.37
- npm @tanstack/react-router-ssr-query: affected >= 1.166.15, <= 1.166.15; >= 1.166.18, <= 1.166.18; fixed in 1.166.19
- npm @tanstack/eslint-plugin-start: affected >= 0.0.4, <= 0.0.4; >= 0.0.7, <= 0.0.7; fixed in 0.0.8
- npm @tanstack/start-plugin-core: affected >= 1.169.23, <= 1.169.23; >= 1.169.26, <= 1.169.26; fixed in 1.169.27
- npm @tanstack/valibot-adapter: affected >= 1.166.12, <= 1.166.12; >= 1.166.15, <= 1.166.15; fixed in 1.166.16
- npm @tanstack/vue-start: affected >= 1.167.61, <= 1.167.61; >= 1.167.64, <= 1.167.64; fixed in 1.167.65
- npm @tanstack/react-router-devtools: affected >= 1.166.16, <= 1.166.16; >= 1.166.19, <= 1.166.19; fixed in 1.166.20
- npm @tanstack/start-fn-stubs: affected >= 1.161.9, <= 1.161.9; >= 1.161.12, <= 1.161.12; fixed in 1.161.13
- npm @tanstack/vue-router-ssr-query: affected >= 1.166.15, <= 1.166.15; >= 1.166.18, <= 1.166.18; fixed in 1.166.19
- npm @tanstack/router-devtools: affected >= 1.166.16, <= 1.166.16; >= 1.166.19, <= 1.166.19; fixed in 1.166.20
- npm @tanstack/solid-router-devtools: affected >= 1.166.16, <= 1.166.16; >= 1.166.19, <= 1.166.19; fixed in 1.166.20
- npm @tanstack/router-cli: affected >= 1.166.46, <= 1.166.46; >= 1.166.49, <= 1.166.49; fixed in 1.166.50
- npm @tanstack/vue-router: affected >= 1.169.5, <= 1.169.5; >= 1.169.8, <= 1.169.8; fixed in 1.169.9
- npm @tanstack/router-generator: affected >= 1.166.45, <= 1.166.45; >= 1.166.48, <= 1.166.48; fixed in 1.166.49
- npm @tanstack/react-start-rsc: affected >= 0.0.47, <= 0.0.47; >= 0.0.50, <= 0.0.50; fixed in 0.0.51
- npm @tanstack/react-start-client: affected >= 1.166.51, <= 1.166.51; >= 1.166.54, <= 1.166.54; fixed in 1.166.55
- npm @tanstack/vue-start-server: affected >= 1.166.50, <= 1.166.50; >= 1.166.53, <= 1.166.53; fixed in 1.166.54
- npm @tanstack/eslint-plugin-router: affected >= 1.161.9, <= 1.161.9; >= 1.161.12, <= 1.161.12; fixed in 1.161.13
- npm @tanstack/nitro-v2-vite-plugin: affected >= 1.154.12, <= 1.154.12; >= 1.154.15, <= 1.154.15; fixed in 1.154.16
- npm @tanstack/virtual-file-routes: affected >= 1.161.10, <= 1.161.10; >= 1.161.13, <= 1.161.13; fixed in 1.161.14
- npm @tanstack/vue-start-client: affected >= 1.166.46, <= 1.166.46; >= 1.166.49, <= 1.166.49; fixed in 1.166.50
- npm @tanstack/arktype-adapter: affected >= 1.166.12, <= 1.166.12; >= 1.166.15, <= 1.166.15; fixed in 1.166.16
- npm @tanstack/solid-start: affected >= 1.167.65, <= 1.167.65; >= 1.167.68, <= 1.167.68; fixed in 1.167.69
- npm @tanstack/router-core: affected >= 1.169.5, <= 1.169.5; >= 1.169.8, <= 1.169.8; fixed in 1.169.9
- npm @tanstack/react-router: affected >= 1.169.5, <= 1.169.5; >= 1.169.8, <= 1.169.8; fixed in 1.169.9
- npm @tanstack/history: affected >= 1.161.9, <= 1.161.9; >= 1.161.12, <= 1.161.12; fixed in 1.161.13
- npm @tanstack/react-start: affected >= 1.167.68, <= 1.167.68; >= 1.167.71, <= 1.167.71; fixed in 1.167.72
- npm @tanstack/router-ssr-query-core: affected >= 1.168.3, <= 1.168.3; >= 1.168.6, <= 1.168.6; fixed in 1.168.7
- npm @tanstack/start-client-core: affected >= 1.168.5, <= 1.168.5; >= 1.168.8, <= 1.168.8; fixed in 1.168.9
- npm @tanstack/solid-router-ssr-query: affected >= 1.166.15, <= 1.166.15; >= 1.166.18, <= 1.166.18; fixed in 1.166.19
- npm @tanstack/router-utils: affected >= 1.161.11, <= 1.161.11; >= 1.161.14, <= 1.161.14; fixed in 1.161.15
- npm @tanstack/router-plugin: affected >= 1.167.38, <= 1.167.38; >= 1.167.41, <= 1.167.41; fixed in 1.167.42
- npm @tanstack/router-devtools-core: affected >= 1.167.6, <= 1.167.6; >= 1.167.9, <= 1.167.9; fixed in 1.167.10
- npm @tanstack/solid-start-client: affected >= 1.166.50, <= 1.166.50; >= 1.166.53, <= 1.166.53; fixed in 1.166.54
- npm @tanstack/router-vite-plugin: affected >= 1.166.53, <= 1.166.53; >= 1.166.56, <= 1.166.56; fixed in 1.166.57
- npm @tanstack/react-start-server: affected >= 1.166.55, <= 1.166.55; >= 1.166.58, <= 1.166.58; fixed in 1.166.59
- npm @tanstack/zod-adapter: affected >= 1.166.12, <= 1.166.12; >= 1.166.15, <= 1.166.15; fixed in 1.166.16
- npm @tanstack/solid-start-server: affected >= 1.166.54, <= 1.166.54; >= 1.166.57, <= 1.166.57; fixed in 1.166.58
- npm @tanstack/vue-router-devtools: affected >= 1.166.16, <= 1.166.16; >= 1.166.19, <= 1.166.19; fixed in 1.166.20

## Suggested inspection (read-only)
- `npm ls @tanstack/start-storage-context --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/solid-router --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/start-static-server-functions --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/start-server-core --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/react-router-ssr-query --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/eslint-plugin-start --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/start-plugin-core --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/valibot-adapter --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/vue-start --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/react-router-devtools --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/start-fn-stubs --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/vue-router-ssr-query --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/router-devtools --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/solid-router-devtools --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/router-cli --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/vue-router --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/router-generator --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/react-start-rsc --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/react-start-client --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/vue-start-server --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/eslint-plugin-router --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/nitro-v2-vite-plugin --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/virtual-file-routes --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/vue-start-client --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/arktype-adapter --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/solid-start --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/router-core --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/react-router --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/history --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/react-start --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/router-ssr-query-core --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/start-client-core --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/solid-router-ssr-query --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/router-utils --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/router-plugin --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/router-devtools-core --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/solid-start-client --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/router-vite-plugin --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/react-start-server --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/zod-adapter --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/solid-start-server --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `npm ls @tanstack/vue-router-devtools --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on @tanstack/start-storage-context, @tanstack/solid-router, @tanstack/start-static-server-functions, @tanstack/start-server-core, @tanstack/react-router-ssr-query, @tanstack/eslint-plugin-start, @tanstack/start-plugin-core, @tanstack/valibot-adapter, @tanstack/vue-start, @tanstack/react-router-devtools, @tanstack/start-fn-stubs, @tanstack/vue-router-ssr-query, @tanstack/router-devtools, @tanstack/solid-router-devtools, @tanstack/router-cli, @tanstack/vue-router, @tanstack/router-generator, @tanstack/react-start-rsc, @tanstack/react-start-client, @tanstack/vue-start-server, @tanstack/eslint-plugin-router, @tanstack/nitro-v2-vite-plugin, @tanstack/virtual-file-routes, @tanstack/vue-start-client, @tanstack/arktype-adapter, @tanstack/solid-start, @tanstack/router-core, @tanstack/react-router, @tanstack/history, @tanstack/react-start, @tanstack/router-ssr-query-core, @tanstack/start-client-core, @tanstack/solid-router-ssr-query, @tanstack/router-utils, @tanstack/router-plugin, @tanstack/router-devtools-core, @tanstack/solid-start-client, @tanstack/router-vite-plugin, @tanstack/react-start-server, @tanstack/zod-adapter, @tanstack/solid-start-server, @tanstack/vue-router-devtools.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-g7cv-rxg3-hmpx (GitHub-reviewed advisory GHSA-g7cv-rxg3-hmpx lists affected ranges: npm @tanstack/arktype-adapter >=1.166.12 =1.166.15 =1.161.9 =1.161.12 =0.0.4 =0.0.7 =1.161.9 =1.161.12 =1.154.12 =1.154.15 =1.169.5 =1.169.8…)
- Verified: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CISA added CVE-2026-45321 to the Known Exploited Vulnerabilities catalog on 2026-05-27.)
- Verified: https://osv.dev/vulnerability/GHSA-g7cv-rxg3-hmpx (OSV record GHSA-g7cv-rxg3-hmpx lists affected ranges: npm @tanstack/arktype-adapter >=1.166.12 =1.166.15 =1.161.9 =1.161.12 =0.0.4 =0.0.7 =1.161.9 =1.161.12 =1.154.12 =1.154.15 <1.154.16 (fixed);…)

Commands are suggestions: review each one before running it.