CVE-2026-45321

🗓️ 12 May 2026 01:16:46Reported by [email protected]Type

Malware published as trusted TanStack packages via GitHub Actions OIDC after misconfig and cache poisoning.

Reporter	Title	Published	Views	Family All 183
GithubExploit	Exploit for Embedded Malicious Code in Tanstack Tanstack\/Arktype-Adapter	25 May 202615:34	–	githubexploit
GithubExploit	Exploit for Embedded Malicious Code in Tanstack Tanstack\/Arktype-Adapter	18 May 202609:16	–	githubexploit
ATTACKERKB	CVE-2026-45321	12 May 202600:12	–	attackerkb
Circl	CVE-2026-45321	12 May 202612:20	–	circl
CISA KEV Catalog	TanStack Unspecified Vulnerability	27 May 202600:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	27 May 202612:00	–	cisa
CNNVD	TanStack Query 安全漏洞	12 May 202600:00	–	cnnvd
CVE	CVE-2026-45321	12 May 202600:12	–	cve
Cvelist	CVE-2026-45321 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys	12 May 202600:12	–	cvelist
EUVD	EUVD-2026-29352	12 May 202600:12	–	euvd

NVD

Node

tanstack tanstack/arktype-adapterMatch1.166.12node.js

tanstack tanstack/arktype-adapterMatch1.166.15node.js

Node

tanstack tanstack/eslint-plugin-routerMatch1.161.9node.js

tanstack tanstack/eslint-plugin-routerMatch1.161.12node.js

Node

tanstack tanstack/eslint-plugin-startMatch0.0.4node.js

tanstack tanstack/eslint-plugin-startMatch0.0.7node.js

Node

tanstack tanstack/historyMatch1.161.9node.js

tanstack tanstack/historyMatch1.161.12node.js

Node

tanstack tanstack/nitro-v2-vite-pluginMatch1.154.12node.js

tanstack tanstack/nitro-v2-vite-pluginMatch1.154.15node.js

Node

tanstack tanstack/react-routerMatch1.169.5node.js

tanstack tanstack/react-routerMatch1.169.8node.js

Node

tanstack tanstack/react-router-devtoolsMatch1.166.16node.js

tanstack tanstack/react-router-devtoolsMatch1.166.19node.js

Node

tanstack tanstack/react-router-ssr-queryMatch1.166.15node.js

tanstack tanstack/react-router-ssr-queryMatch1.166.18node.js

Node

tanstack tanstack/react-startMatch1.167.68node.js

tanstack tanstack/react-startMatch1.167.71node.js

Node

tanstack tanstack/react-start-clientMatch1.166.51node.js

tanstack tanstack/react-start-clientMatch1.166.54node.js

Node

tanstack tanstack/react-start-rscMatch0.0.47node.js

tanstack tanstack/react-start-rscMatch0.0.50node.js

Node

tanstack tanstack/react-start-serverMatch1.166.55node.js

tanstack tanstack/react-start-serverMatch1.166.58node.js

Node

tanstack tanstack/router-cliMatch1.166.46node.js

tanstack tanstack/router-cliMatch1.166.49node.js

Node

tanstack tanstack/router-coreMatch1.169.5node.js

tanstack tanstack/router-coreMatch1.169.8node.js

Node

tanstack tanstack/router-devtoolsMatch1.166.16node.js

tanstack tanstack/router-devtoolsMatch1.166.19node.js

Node

tanstack tanstack/router-devtools-coreMatch1.167.6node.js

tanstack tanstack/router-devtools-coreMatch1.167.9node.js

Node

tanstack tanstack/router-generatorMatch1.166.45node.js

tanstack tanstack/router-generatorMatch1.166.48node.js

Node

tanstack tanstack/router-pluginMatch1.167.38node.js

tanstack tanstack/router-pluginMatch1.167.41node.js

Node

tanstack tanstack/router-ssr-query-coreMatch1.168.3node.js

tanstack tanstack/router-ssr-query-coreMatch1.168.6node.js

Node

tanstack tanstack/router-utilsMatch1.161.11node.js

tanstack tanstack/router-utilsMatch1.161.14node.js

Node

tanstack tanstack/router-vite-pluginMatch1.166.53node.js

tanstack tanstack/router-vite-pluginMatch1.166.56node.js

Node

tanstack tanstack/solid-routerMatch1.169.5node.js

tanstack tanstack/solid-routerMatch1.169.8node.js

Node

tanstack tanstack/solid-router-devtoolsMatch1.166.16node.js

tanstack tanstack/solid-router-devtoolsMatch1.166.19node.js

Node

tanstack tanstack/solid-router-ssr-queryMatch1.166.15node.js

tanstack tanstack/solid-router-ssr-queryMatch1.166.18node.js

Node

tanstack tanstack/solid-startMatch1.167.65node.js

tanstack tanstack/solid-startMatch1.167.68node.js

Node

tanstack tanstack/solid-start-clientMatch1.166.50node.js

tanstack tanstack/solid-start-clientMatch1.166.53node.js

Node

tanstack tanstack/solid-start-serverMatch1.166.54node.js

tanstack tanstack/solid-start-serverMatch1.166.57node.js

Node

tanstack tanstack/start-client-coreMatch1.168.5node.js

tanstack tanstack/start-client-coreMatch1.168.8node.js

Node

tanstack tanstack/start-fn-stubsMatch1.161.9node.js

tanstack tanstack/start-fn-stubsMatch1.161.12node.js

Node

tanstack tanstack/start-plugin-coreMatch1.169.23node.js

tanstack tanstack/start-plugin-coreMatch1.169.26node.js

Node

tanstack tanstack/start-server-coreMatch1.167.33node.js

tanstack tanstack/start-server-coreMatch1.167.36node.js

Node

tanstack tanstack/start-static-server-functionsMatch1.166.44node.js

tanstack tanstack/start-static-server-functionsMatch1.166.47node.js

Node

tanstack tanstack/start-storage-contextMatch1.166.38node.js

tanstack tanstack/start-storage-contextMatch1.166.41node.js

Node

tanstack tanstack/valibot-adapterMatch1.166.12node.js

tanstack tanstack/valibot-adapterMatch1.166.15node.js

Node

tanstack tanstack/virtual-file-routesMatch1.161.10node.js

tanstack tanstack/virtual-file-routesMatch1.161.13node.js

Node

tanstack tanstack/vue-routerMatch1.169.5node.js

tanstack tanstack/vue-routerMatch1.169.8node.js

Node

tanstack tanstack/vue-router-devtoolsMatch1.166.16node.js

tanstack tanstack/vue-router-devtoolsMatch1.166.19node.js

Node

tanstack tanstack/vue-router-ssr-queryMatch1.166.15node.js

tanstack tanstack/vue-router-ssr-queryMatch1.166.18node.js

Node

tanstack tanstack/vue-startMatch1.167.61node.js

tanstack tanstack/vue-startMatch1.167.64node.js

Node

tanstack tanstack/vue-start-clientMatch1.166.46node.js

tanstack tanstack/vue-start-clientMatch1.166.49node.js

Node

tanstack tanstack/vue-start-serverMatch1.166.50node.js

tanstack tanstack/vue-start-serverMatch1.166.53node.js

Node

tanstack tanstack/zod-adapterMatch1.166.12node.js

tanstack tanstack/zod-adapterMatch1.166.15node.js

Node

mistral mistralaiMatch2.4.6python

mistral mistralai/mistralaiMatch2.2.3node.js

mistral mistralai/mistralaiMatch2.2.4node.js

mistral mistralai/mistralai-azureMatch1.7.2node.js

mistral mistralai/mistralai-azureMatch1.7.3node.js

mistral mistralai/mistralai-gcpMatch1.7.2node.js

mistral mistralai/mistralai-gcpMatch1.7.3node.js

Node

antoinebcx ml-toolkit-tsMatch1.0.4node.js

antoinebcx ml-toolkit-tsMatch1.0.5node.js

antoinebcx ml-toolkit-ts/preprocessingMatch1.0.2node.js

antoinebcx ml-toolkit-ts/preprocessingMatch1.0.3node.js

antoinebcx ml-toolkit-ts/xgboostMatch1.0.3node.js

antoinebcx ml-toolkit-ts/xgboostMatch1.0.4node.js

Node

beproduct beproduct/nestjs-authMatch0.1.2node.js

beproduct beproduct/nestjs-authMatch0.1.3node.js

beproduct beproduct/nestjs-authMatch0.1.4node.js

beproduct beproduct/nestjs-authMatch0.1.5node.js

beproduct beproduct/nestjs-authMatch0.1.6node.js

beproduct beproduct/nestjs-authMatch0.1.7node.js

beproduct beproduct/nestjs-authMatch0.1.8node.js

beproduct beproduct/nestjs-authMatch0.1.9node.js

beproduct beproduct/nestjs-authMatch0.1.10node.js

beproduct beproduct/nestjs-authMatch0.1.11node.js

beproduct beproduct/nestjs-authMatch0.1.12node.js

beproduct beproduct/nestjs-authMatch0.1.13node.js

beproduct beproduct/nestjs-authMatch0.1.14node.js

beproduct beproduct/nestjs-authMatch0.1.15node.js

beproduct beproduct/nestjs-authMatch0.1.16node.js

beproduct beproduct/nestjs-authMatch0.1.17node.js

beproduct beproduct/nestjs-authMatch0.1.19node.js

Node

christianalares git-git-gitMatch1.0.8node.js

christianalares git-git-gitMatch1.0.9node.js

christianalares git-git-gitMatch1.0.10node.js

christianalares git-git-gitMatch1.0.12node.js

christianalares git_branch_selectorMatch1.3.3node.js

christianalares git_branch_selectorMatch1.3.4node.js

christianalares git_branch_selectorMatch1.3.5node.js

christianalares git_branch_selectorMatch1.3.7node.js

christianalares nextmove-mcpMatch0.1.3node.js

christianalares nextmove-mcpMatch0.1.4node.js

christianalares nextmove-mcpMatch0.1.5node.js

christianalares nextmove-mcpMatch0.1.7node.js

christianalares tolka/cliMatch1.0.2node.js

christianalares tolka/cliMatch1.0.3node.js

christianalares tolka/cliMatch1.0.4node.js

christianalares tolka/cliMatch1.0.6node.js

Node

multiagentcognition cmux-agent-mcpMatch0.1.3node.js

multiagentcognition cmux-agent-mcpMatch0.1.4node.js

multiagentcognition cmux-agent-mcpMatch0.1.5node.js

multiagentcognition cmux-agent-mcpMatch0.1.6node.js

multiagentcognition cmux-agent-mcpMatch0.1.7node.js

multiagentcognition cmux-agent-mcpMatch0.1.8node.js

Node

abhishake1 supersurkhet/cliMatch0.0.2node.js

abhishake1 supersurkhet/cliMatch0.0.3node.js

abhishake1 supersurkhet/cliMatch0.0.4node.js

abhishake1 supersurkhet/cliMatch0.0.5node.js

abhishake1 supersurkhet/cliMatch0.0.6node.js

abhishake1 supersurkhet/cliMatch0.0.7node.js

abhishake1 supersurkhet/sdkMatch0.0.2node.js

abhishake1 supersurkhet/sdkMatch0.0.3node.js

abhishake1 supersurkhet/sdkMatch0.0.4node.js

abhishake1 supersurkhet/sdkMatch0.0.5node.js

abhishake1 supersurkhet/sdkMatch0.0.6node.js

abhishake1 supersurkhet/sdkMatch0.0.7node.js

abhishake1 taskflow-corp/cliMatch0.1.24node.js

abhishake1 taskflow-corp/cliMatch0.1.25node.js

abhishake1 taskflow-corp/cliMatch0.1.26node.js

abhishake1 taskflow-corp/cliMatch0.1.27node.js

abhishake1 taskflow-corp/cliMatch0.1.28node.js

abhishake1 taskflow-corp/cliMatch0.1.29node.js

Node

kilbot tallyui/componentsMatch1.0.1node.js

kilbot tallyui/componentsMatch1.0.2node.js

kilbot tallyui/componentsMatch1.0.3node.js

kilbot tallyui/connector-medusaMatch1.0.1node.js

kilbot tallyui/connector-medusaMatch1.0.2node.js

kilbot tallyui/connector-medusaMatch1.0.3node.js

kilbot tallyui/connector-shopifyMatch1.0.1node.js

kilbot tallyui/connector-shopifyMatch1.0.2node.js

kilbot tallyui/connector-shopifyMatch1.0.3node.js

kilbot tallyui/connector-vendureMatch1.0.1node.js

kilbot tallyui/connector-vendureMatch1.0.2node.js

kilbot tallyui/connector-vendureMatch1.0.3node.js

kilbot tallyui/connector-woocommerceMatch1.0.1node.js

kilbot tallyui/connector-woocommerceMatch1.0.2node.js

kilbot tallyui/connector-woocommerceMatch1.0.3node.js

kilbot tallyui/coreMatch0.2.1node.js

kilbot tallyui/coreMatch0.2.2node.js

kilbot tallyui/coreMatch0.2.3node.js

kilbot tallyui/databaseMatch1.0.1node.js

kilbot tallyui/databaseMatch1.0.2node.js

kilbot tallyui/databaseMatch1.0.3node.js

kilbot tallyui/posMatch0.1.1node.js

kilbot tallyui/posMatch0.1.2node.js

kilbot tallyui/posMatch0.1.3node.js

kilbot tallyui/storage-sqliteMatch0.2.1node.js

kilbot tallyui/storage-sqliteMatch0.2.2node.js

kilbot tallyui/storage-sqliteMatch0.2.3node.js

kilbot tallyui/themeMatch0.2.1node.js

kilbot tallyui/themeMatch0.2.2node.js

kilbot tallyui/themeMatch0.2.3node.js

Node

matheuspergoli draftauth/clientMatch0.2.1node.js

matheuspergoli draftauth/clientMatch0.2.2node.js

matheuspergoli draftauth/coreMatch0.13.1node.js

matheuspergoli draftauth/coreMatch0.13.2node.js

matheuspergoli draftlab/authMatch0.24.1node.js

matheuspergoli draftlab/authMatch0.24.2node.js

matheuspergoli draftlab/auth-routerMatch0.5.1node.js

matheuspergoli draftlab/auth-routerMatch0.5.2node.js

matheuspergoli draftlab/dbMatch0.16.1node.js

matheuspergoli draftlab/dbMatch0.16.2node.js

matheuspergoli simple_type-safe_actionsMatch0.8.3node.js

matheuspergoli simple_type-safe_actionsMatch0.8.4node.js

Node

neilcochran cross-stitchMatch1.1.3node.js

neilcochran cross-stitchMatch1.1.4node.js

neilcochran cross-stitchMatch1.1.6node.js

neilcochran squawk/airportsMatch0.6.2node.js

neilcochran squawk/airportsMatch0.6.3node.js

neilcochran squawk/airportsMatch0.6.5node.js

neilcochran squawk/airspaceMatch0.8.1node.js

neilcochran squawk/airspaceMatch0.8.2node.js

neilcochran squawk/airspaceMatch0.8.4node.js

neilcochran squawk/airspace-dataMatch0.5.3node.js

neilcochran squawk/airspace-dataMatch0.5.4node.js

neilcochran squawk/airspace-dataMatch0.5.6node.js

neilcochran squawk/airway-dataMatch0.5.4node.js

neilcochran squawk/airway-dataMatch0.5.5node.js

neilcochran squawk/airway-dataMatch0.5.7node.js

neilcochran squawk/airwaysMatch0.4.2node.js

neilcochran squawk/airwaysMatch0.4.3node.js

neilcochran squawk/airwaysMatch0.4.5node.js

neilcochran squawk/fix-dataMatch0.6.4node.js

neilcochran squawk/fix-dataMatch0.6.5node.js

neilcochran squawk/fix-dataMatch0.6.7node.js

neilcochran squawk/fixesMatch0.3.2node.js

neilcochran squawk/fixesMatch0.3.3node.js

neilcochran squawk/fixesMatch0.3.5node.js

neilcochran squawk/flight-mathMatch0.5.4node.js

neilcochran squawk/flight-mathMatch0.5.5node.js

neilcochran squawk/flight-mathMatch0.5.7node.js

neilcochran squawk/flightplanMatch0.5.2node.js

neilcochran squawk/flightplanMatch0.5.3node.js

neilcochran squawk/flightplanMatch0.5.5node.js

neilcochran squawk/geoMatch0.4.4node.js

neilcochran squawk/geoMatch0.4.5node.js

neilcochran squawk/geoMatch0.4.7node.js

neilcochran squawk/icao-registryMatch0.5.2node.js

neilcochran squawk/icao-registryMatch0.5.3node.js

neilcochran squawk/icao-registryMatch0.5.5node.js

neilcochran squawk/icao-registry-dataMatch0.8.4node.js

neilcochran squawk/icao-registry-dataMatch0.8.5node.js

neilcochran squawk/icao-registry-dataMatch0.8.7node.js

neilcochran squawk/mcpMatch0.9.1node.js

neilcochran squawk/mcpMatch0.9.2node.js

neilcochran squawk/mcpMatch0.9.4node.js

neilcochran squawk/navaid-dataMatch0.6.4node.js

neilcochran squawk/navaid-dataMatch0.6.5node.js

neilcochran squawk/navaid-dataMatch0.6.7node.js

neilcochran squawk/navaidsMatch0.4.2node.js

neilcochran squawk/navaidsMatch0.4.3node.js

neilcochran squawk/navaidsMatch0.4.5node.js

neilcochran squawk/notamsMatch0.3.6node.js

neilcochran squawk/notamsMatch0.3.7node.js

neilcochran squawk/notamsMatch0.3.9node.js

neilcochran squawk/procedure-dataMatch0.7.3node.js

neilcochran squawk/procedure-dataMatch0.7.4node.js

neilcochran squawk/procedure-dataMatch0.7.6node.js

neilcochran squawk/proceduresMatch0.5.2node.js

neilcochran squawk/proceduresMatch0.5.3node.js

neilcochran squawk/proceduresMatch0.5.5node.js

neilcochran squawk/typesMatch0.8.1node.js

neilcochran squawk/typesMatch0.8.2node.js

neilcochran squawk/typesMatch0.8.4node.js

neilcochran squawk/unitsMatch0.4.3node.js

neilcochran squawk/unitsMatch0.4.4node.js

neilcochran squawk/unitsMatch0.4.6node.js

neilcochran squawk/weatherMatch0.5.6node.js

neilcochran squawk/weatherMatch0.5.7node.js

neilcochran squawk/weatherMatch0.5.9node.js

neilcochran ts-dnaMatch3.0.1node.js

neilcochran ts-dnaMatch3.0.2node.js

neilcochran ts-dnaMatch3.0.4node.js

neilcochran wot-apiMatch0.8.1node.js

neilcochran wot-apiMatch0.8.2node.js

neilcochran wot-apiMatch0.8.4node.js

Node

agentworkhq agentwork-cliMatch0.1.4node.js

agentworkhq agentwork-cliMatch0.1.5node.js

dirigible dirigible-ai/sdkMatch0.6.2node.js

dirigible dirigible-ai/sdkMatch0.6.3node.js

guardrailsai guardrails_aiMatch0.10.1python

linuxfoundation opensearchMatch3.6.2node.js

mesa mesadev/restMatch0.28.3node.js

mesa mesadev/saguaroMatch0.4.22node.js

mesa mesadev/sdkMatch0.28.3node.js

Node

uipath uipath/access-policy-sdkMatch0.3.1node.js

uipath uipath/access-policy-toolMatch0.3.1node.js

uipath uipath/admin-toolMatch0.1.1node.js

uipath uipath/agent-sdkMatch1.0.2node.js

uipath uipath/agent-toolMatch1.0.1node.js

uipath uipath/agent.sdkMatch0.0.18node.js

uipath uipath/aops-policy-toolMatch0.3.1node.js

uipath uipath/ap-chatMatch1.5.7node.js

uipath uipath/api-workflow-toolMatch1.0.1node.js

uipath uipath/apollo-coreMatch5.9.2node.js

uipath uipath/apollo-reactMatch4.24.5node.js

uipath uipath/apollo-windMatch2.16.2node.js

uipath uipath/authMatch1.0.1node.js

uipath uipath/case-toolMatch1.0.1node.js

uipath uipath/cliMatch1.0.1node.js

uipath uipath/codedagent-toolMatch1.0.1node.js

uipath uipath/codedagents-toolMatch0.1.12node.js

uipath uipath/codedapp-toolMatch1.0.1node.js

uipath uipath/commonMatch1.0.1node.js

uipath uipath/context-grounding-toolMatch0.1.1node.js

uipath uipath/data-fabric-toolMatch1.0.2node.js

uipath uipath/docsai-toolMatch1.0.1node.js

uipath uipath/filesystemMatch1.0.1node.js

uipath uipath/flow-toolMatch1.0.2node.js

uipath uipath/functions-toolMatch1.0.1node.js

uipath uipath/gov-toolMatch0.3.1node.js

uipath uipath/identity-toolMatch0.1.1node.js

uipath uipath/insights-sdkMatch1.0.1node.js

uipath uipath/insights-toolMatch1.0.1node.js

uipath uipath/integrationservice-sdkMatch1.0.2node.js

uipath uipath/integrationservice-toolMatch1.0.2node.js

uipath uipath/llmgw-toolMatch1.0.1node.js

uipath uipath/maestro-sdkMatch1.0.1node.js

uipath uipath/maestro-toolMatch1.0.1node.js

uipath uipath/orchestrator-toolMatch1.0.1node.js

uipath uipath/packager-tool-apiworkflowMatch0.0.19node.js

uipath uipath/packager-tool-bpmnMatch0.0.9node.js

uipath uipath/packager-tool-caseMatch0.0.9node.js

uipath uipath/packager-tool-connectorMatch0.0.19node.js

uipath uipath/packager-tool-flowMatch0.0.19node.js

uipath uipath/packager-tool-functionsMatch0.1.1node.js

uipath uipath/packager-tool-webappMatch1.0.6node.js

uipath uipath/packager-tool-workflowcompilerMatch0.0.16node.js

uipath uipath/packager-tool-workflowcompiler-browserMatch0.0.34node.js

uipath uipath/platform-toolMatch1.0.1node.js

uipath uipath/project-packagerMatch1.1.16node.js

uipath uipath/resource-toolMatch1.0.1node.js

uipath uipath/resourcecatalog-toolMatch0.1.1node.js

uipath uipath/resources-toolMatch0.1.11node.js

uipath uipath/robotMatch1.3.4node.js

uipath uipath/rpa-legacy-toolMatch1.0.1node.js

uipath uipath/rpa-toolMatch0.9.5node.js

uipath uipath/solution-packagerMatch0.0.35node.js

uipath uipath/solution-toolMatch1.0.1node.js

uipath uipath/solutionpackager-sdkMatch1.0.11node.js

uipath uipath/solutionpackager-tool-coreMatch0.0.34node.js

uipath uipath/tasks-toolMatch1.0.1node.js

uipath uipath/telemetryMatch0.0.7node.js

uipath uipath/test-manager-toolMatch1.0.2node.js

uipath uipath/tool-workflowcompilerMatch0.0.12node.js

uipath uipath/traces-toolMatch1.0.1node.js

uipath uipath/ui-widgets-multi-file-uploadMatch1.0.1node.js

uipath uipath/uipath-python-bridgeMatch1.0.1node.js

uipath uipath/vertical-solutions-toolMatch1.0.1node.js

uipath uipath/vssMatch0.1.6node.js

uipath uipath/widget.sdkMatch1.2.3node.js

Source	Link
tanstack	www.tanstack.com/blog/npm-supply-chain-compromise-postmortem
github	www.github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
stepsecurity	www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem
github	www.github.com/TanStack/router/issues/7383
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

29 May 2026 19:41Current

CVSS 3.19.6

EPSS0.17051

CWE-506