CVE-2026-45321 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

🗓️ 12 May 2026 00:12:35Reported by GoogleType

osv🔗 osv.dev👁 1 Views

Malware in TanStack packages exfiltrates credentials and tokens; 84 malicious versions across 42 packages published on 2026-05-11 via GitHub Actions trusted-publisher.

Reporter	Title	Published	Views	Family All 183
GithubExploit	Exploit for Embedded Malicious Code in Tanstack Tanstack\/Arktype-Adapter	25 May 202615:34	–	githubexploit
GithubExploit	Exploit for Embedded Malicious Code in Tanstack Tanstack\/Arktype-Adapter	18 May 202609:16	–	githubexploit
ATTACKERKB	CVE-2026-45321	12 May 202600:12	–	attackerkb
BDU FSTEC	The vulnerability of the TanStack library set, related to the presence of undeclared capabilities, allows a hacker to execute arbitrary code.	13 May 202600:00	–	bdu_fstec
Circl	CVE-2026-45321	12 May 202612:20	–	circl
CISA KEV Catalog	TanStack Unspecified Vulnerability	27 May 202600:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	27 May 202612:00	–	cisa
CNNVD	TanStack Query 安全漏洞	12 May 202600:00	–	cnnvd
CVE	CVE-2026-45321	12 May 202600:12	–	cve
Cvelist	CVE-2026-45321 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys	12 May 202600:12	–	cvelist

Source	Link
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45321.json
github	www.github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45321
github	www.github.com/TanStack/router/issues/7383
tanstack	www.tanstack.com/blog/npm-supply-chain-compromise-postmortem
stepsecurity	www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem

15 Jul 2026 01:48Current

7.4High risk

Vulners AI Score7.4

CVSS 3.19.6

EPSS0.02342