CVE-2026-45321 — Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

Affected: @tanstack arktype-adapter, @tanstack eslint-plugin-router, @tanstack eslint-plugin-start, @tanstack history, @tanstack nitro-v2-vite-plugin, @tanstack react-router, @tanstack react-router-devtools, @tanstack react-router-ssr-query, @tanstack react-start, @tanstack react-start-client and 32 more

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

GHSA-g7cv-rxg3-hmpx — Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

Affected: npm: @tanstack/arktype-adapter, npm: @tanstack/eslint-plugin-router, npm: @tanstack/eslint-plugin-start, npm: @tanstack/history, npm: @tanstack/nitro-v2-vite-plugin, npm: @tanstack/react-router, npm: @tanstack/react-router-devtools, npm: @tanstack/react-router-ssr-query, npm: @tanstack/react-start, npm: @tanstack/react-start-client and 32 more

## Summary

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.

Each affected package received exactly two malicious versions, published a few minutes apart.

## Impact

A user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:

- Harvests credentials from common locations: - AWS instance metadata (IMDS) and Secrets Manager - GCP metadata service - Kubernetes service-account tokens - HashiCorp Vault tokens - `~/.npmrc` (npm tokens) - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`) - SSH private keys (`~/.ssh/`) - Exfiltrates harvested data over the Session/Oxen messenger file-upload network (`filev2.getsession.org`, `seed{1,2,3}.getsession.org`). This is end-to-end encrypted with no attacker-controlled C2, so blocking by IP or domain is the only network mitigation. - Enumerates packages that the victim…

Most recent entries from all

CVE-2026-45321 — Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

GHSA-g7cv-rxg3-hmpx — Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys