tanscript-exploit-check

Mini Shai-Hulud Supply Chain Attack — IOC Checker root@kitploit: curl -fsSL https://raw.githubusercontent.com/nkopylov/tanscript-exploit-check/main/check-tanstack-exploit.sh | bash Or clone and run locally: root@kitploit: git clone https://github.com/nkopylov/tanscript-exploit-check.git cd...

CVE-2026-45321-Tanstack

Simulasi Supply Chain Attack — CVE-2026-45321 TanStack Educational Lab for Understanding npm Supply Chain Attacks, CI/CD Abuse, and Install-Time Code Execution Disclaimer Project ini dibuat hanya untuk: pembelajaran keamanan siber, riset defensive security, simulasi local lab, memahami konsep...

CVE-2026-45321-Tanstack

Supply Chain Attack Simulation — CVE-2026-45321 TanStack Educational Lab for Understanding npm Supply Chain Attacks, CI/CD Abuse, and Install-Time Code Execution Disclaimer This project is created only for: cybersecurity learning, defensive security research, local lab simulation, understanding t...

tanstack-compromise-checker

tanstack-compromise-checker Detect indicators of the TanStack npm supply-chain attack on a developer machine, a repository, or a CI runner. Bash script, Docker image, and GitHub Action — same engine, three entry points. CVE-2026-45321 /GHSA-g7cv-rxg3-hmpx On May 11 2026, attackers published 84...

CVE-2026-26903-PoC

CVE-2026-26903 PoC Denial-of-service via unbounded recursion in TanStack Query'sreplaceEqualDeep function A single crafted query update with deeply nested objects can freeze the JavaScript thread indefinitely , causing complete application unresponsiveness. No authentication or special permission...

are-you-get-tanstack-attack

TanStack Router CVE Scanner A security scanning tool to detect the TanStack Router CVE | TanStack Router GHSA in your projects. Overview This tool scans your codebase for indicators of the TanStack Router vulnerability CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx, which affects specific versions of...

tanstack-shield

🛡️ tanstack-shield One-command supply-chain attack scanner for CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx Detects the "Mini Shai-Hulud" worm that compromised 42 @tanstack/ npm packages 84 malicious versions on May 11, 2026. root@kitploit: One line — scan your project curl -fsSL...

tanstack-compromise-checker

tanstack-compromise-checker ⚠️ Disclaimer: This tool was built for my own use case. All indicators are derived from the following advisory sources: GHSA-g7cv-rxg3-hmpx Snyk: TanStack npm packages compromised StepSecurity: Mini Shai-Hulud deep dive If new IOCs, payload variants, or attacker...

CVE-2026-78177

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

CVE-2026-78177 TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

EUVD-2026-64694

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

CVE-2026-78177 TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

CVE-2026-78177

TanStack devtools-vite 0.7.0 is affected by an OS command injection vulnerability in the installPackage function within packages/devtools-bundler-core/src/package-manager.ts (component: Development Devtools Event Bus). The root cause is unsanitized handling of the packageName argument, allowing a...

MAL-2026-11930 Malicious code in @servicetitan/tanstack-query-mobx (npm)

npm/@servicetitan/tanstack-query-mobx is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...

CVE-2026-15607

A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the component Alias Path Handler. The manipulation results in improperly controlled modification of object prototype attributes. The attack ma...

CVE-2026-15607

A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the component Alias Path Handler. The manipulation results in improperly controlled modification of object prototype attributes. The attack ma...

CVE-2026-15607 tanstack db Alias Path select.ts select prototype pollution

A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the component Alias Path Handler. The manipulation results in improperly controlled modification of object prototype attributes. The attack ma...

CVE-2026-15607 tanstack db Alias Path select.ts select prototype pollution

A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the component Alias Path Handler. The manipulation results in improperly controlled modification of object prototype attributes. The attack ma...

CVE-2026-15607

TanStack DB up to 0.6.8 contains a vulnerability in the Alias Path Handler’s select function (src/query/compiler/select.ts) that allows improperly controlled modification of object prototype attributes (prototype pollution). Impacted component: TanStack DB; vulnerability arises from the select fu...

Malicious code in autotel-tanstack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84ab5510b146ce55059a16ae8610a9ca1c6ad6fffd42ad2a9c4cb09c2d11675f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...