Embedded Malicious Code

🗓️ 12 May 2026 19:56:25Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 31 Views

TanStack packages suffer embedded malicious code from misconfigured GitHub Actions and cache poisoning enabling token theft and malicious releases.

Reporter	Title	Published	Views	Family All 183
GithubExploit	Exploit for Embedded Malicious Code in Tanstack Tanstack\/Arktype-Adapter	25 May 202615:34	–	githubexploit
GithubExploit	Exploit for Embedded Malicious Code in Tanstack Tanstack\/Arktype-Adapter	18 May 202609:16	–	githubexploit
ATTACKERKB	CVE-2026-45321	12 May 202600:12	–	attackerkb
BDU FSTEC	The vulnerability of the TanStack library set, related to the presence of undeclared capabilities, allows a hacker to execute arbitrary code.	13 May 202600:00	–	bdu_fstec
Circl	CVE-2026-45321	12 May 202612:20	–	circl
CISA KEV Catalog	TanStack Unspecified Vulnerability	27 May 202600:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	27 May 202612:00	–	cisa
CNNVD	TanStack Query 安全漏洞	12 May 202600:00	–	cnnvd
CVE	CVE-2026-45321	12 May 202600:12	–	cve
Cvelist	CVE-2026-45321 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys	12 May 202600:12	–	cvelist

Vulners

Node

arktype-adapter @tanstack/arktype-adapterMatch1.166.15js

arktype-adapter @tanstack/arktype-adapterMatch1.166.12js

arktype-adapter @tanstack/arktype-adapterRange1.166.12–1.166.15js

eslint-plugin-router @tanstack/eslint-plugin-routerMatch1.161.12js

eslint-plugin-router @tanstack/eslint-plugin-routerMatch1.161.9js

eslint-plugin-router @tanstack/eslint-plugin-routerRange1.161.9–1.161.12js

history @tanstack/historyMatch1.161.12js

history @tanstack/historyMatch1.161.9js

history @tanstack/historyRange1.161.9–1.161.12js

eslint-plugin-start @tanstack/eslint-plugin-startMatch0.0.4js

eslint-plugin-start @tanstack/eslint-plugin-startMatch0.0.7js

eslint-plugin-start @tanstack/eslint-plugin-startRange0.0.4–0.0.7js

nitro-v2-vite-plugin @tanstack/nitro-v2-vite-pluginMatch1.154.12js

nitro-v2-vite-plugin @tanstack/nitro-v2-vite-pluginMatch1.154.15js

nitro-v2-vite-plugin @tanstack/nitro-v2-vite-pluginRange1.154.12–1.154.15js

react-start-client @tanstack/react-start-clientMatch1.166.54js

react-start-client @tanstack/react-start-clientMatch1.166.51js

react-start-client @tanstack/react-start-clientRange1.166.51–1.166.54js

react-router-devtools @tanstack/react-router-devtoolsMatch1.166.16js

react-router-devtools @tanstack/react-router-devtoolsMatch1.166.19js

react-router-devtools @tanstack/react-router-devtoolsRange1.166.16–1.166.19js

react-router-ssr-query @tanstack/react-router-ssr-queryMatch1.166.18js

react-router-ssr-query @tanstack/react-router-ssr-queryMatch1.166.15js

react-router-ssr-query @tanstack/react-router-ssr-queryRange1.166.15–1.166.18js

react-start @tanstack/react-startMatch1.167.68js

react-start @tanstack/react-startMatch1.167.71js

react-start @tanstack/react-startRange1.167.68–1.167.71js

react-router @tanstack/react-routerMatch1.169.5js

react-router @tanstack/react-routerMatch1.169.8js

react-router @tanstack/react-routerRange1.169.5–1.169.8js

router-cli @tanstack/router-cliMatch1.166.49js

router-cli @tanstack/router-cliMatch1.166.46js

router-cli @tanstack/router-cliRange1.166.46–1.166.49js

router-core @tanstack/router-coreMatch1.169.8js

router-core @tanstack/router-coreMatch1.169.5js

router-core @tanstack/router-coreRange1.169.5–1.169.8js

react-start-server @tanstack/react-start-serverMatch1.166.55js

react-start-server @tanstack/react-start-serverMatch1.166.58js

react-start-server @tanstack/react-start-serverRange1.166.55–1.166.58js

react-start-rsc @tanstack/react-start-rscMatch0.0.50js

react-start-rsc @tanstack/react-start-rscMatch0.0.47js

react-start-rsc @tanstack/react-start-rscRange0.0.47–0.0.50js

router-devtools @tanstack/router-devtoolsMatch1.166.16js

router-devtools @tanstack/router-devtoolsMatch1.166.19js

router-devtools @tanstack/router-devtoolsRange1.166.16–1.166.19js

router-generator @tanstack/router-generatorMatch1.166.48js

router-generator @tanstack/router-generatorMatch1.166.45js

router-generator @tanstack/router-generatorRange1.166.45–1.166.48js

router-plugin @tanstack/router-pluginMatch1.167.41js

router-plugin @tanstack/router-pluginMatch1.167.38js

router-plugin @tanstack/router-pluginRange1.167.38–1.167.41js

router-utils @tanstack/router-utilsMatch1.161.14js

router-utils @tanstack/router-utilsMatch1.161.11js

router-utils @tanstack/router-utilsRange1.161.11–1.161.14js

router-devtools-core @tanstack/router-devtools-coreMatch1.167.9js

router-devtools-core @tanstack/router-devtools-coreMatch1.167.6js

router-devtools-core @tanstack/router-devtools-coreRange1.167.6–1.167.9js

router-ssr-query-core @tanstack/router-ssr-query-coreMatch1.168.3js

router-ssr-query-core @tanstack/router-ssr-query-coreMatch1.168.6js

router-ssr-query-core @tanstack/router-ssr-query-coreRange1.168.3–1.168.6js

router-vite-plugin @tanstack/router-vite-pluginMatch1.166.53js

router-vite-plugin @tanstack/router-vite-pluginMatch1.166.56js

router-vite-plugin @tanstack/router-vite-pluginRange1.166.53–1.166.56js

solid-router @tanstack/solid-routerMatch1.169.8js

solid-router @tanstack/solid-routerMatch1.169.5js

solid-router @tanstack/solid-routerRange1.169.5–1.169.8js

solid-router-devtools @tanstack/solid-router-devtoolsMatch1.166.16js

solid-router-devtools @tanstack/solid-router-devtoolsMatch1.166.19js

solid-router-devtools @tanstack/solid-router-devtoolsRange1.166.16–1.166.19js

solid-router-ssr-query @tanstack/solid-router-ssr-queryMatch1.166.18js

solid-router-ssr-query @tanstack/solid-router-ssr-queryMatch1.166.15js

solid-router-ssr-query @tanstack/solid-router-ssr-queryRange1.166.15–1.166.18js

solid-start @tanstack/solid-startMatch1.167.68js

solid-start @tanstack/solid-startMatch1.167.65js

solid-start @tanstack/solid-startRange1.167.65–1.167.68js

start-plugin-core @tanstack/start-plugin-coreMatch1.169.26js

start-plugin-core @tanstack/start-plugin-coreMatch1.169.23js

start-plugin-core @tanstack/start-plugin-coreRange1.169.23–1.169.26js

start-fn-stubs @tanstack/start-fn-stubsMatch1.161.12js

start-fn-stubs @tanstack/start-fn-stubsMatch1.161.9js

start-fn-stubs @tanstack/start-fn-stubsRange1.161.9–1.161.12js

solid-start-server @tanstack/solid-start-serverMatch1.166.54js

solid-start-server @tanstack/solid-start-serverMatch1.166.57js

solid-start-server @tanstack/solid-start-serverRange1.166.54–1.166.57js

solid-start-client @tanstack/solid-start-clientMatch1.166.50js

solid-start-client @tanstack/solid-start-clientMatch1.166.53js

solid-start-client @tanstack/solid-start-clientRange1.166.50–1.166.53js

start-client-core @tanstack/start-client-coreMatch1.168.5js

start-client-core @tanstack/start-client-coreMatch1.168.8js

start-client-core @tanstack/start-client-coreRange1.168.5–1.168.8js

valibot-adapter @tanstack/valibot-adapterMatch1.166.12js

valibot-adapter @tanstack/valibot-adapterMatch1.166.15js

valibot-adapter @tanstack/valibot-adapterRange1.166.12–1.166.15js

start-storage-context @tanstack/start-storage-contextMatch1.166.41js

start-storage-context @tanstack/start-storage-contextMatch1.166.38js

start-storage-context @tanstack/start-storage-contextRange1.166.38–1.166.41js

start-static-server-functions @tanstack/start-static-server-functionsMatch1.166.47js

start-static-server-functions @tanstack/start-static-server-functionsMatch1.166.44js

start-static-server-functions @tanstack/start-static-server-functionsRange1.166.44–1.166.47js

virtual-file-routes @tanstack/virtual-file-routesMatch1.161.13js

virtual-file-routes @tanstack/virtual-file-routesMatch1.161.10js

virtual-file-routes @tanstack/virtual-file-routesRange1.161.10–1.161.13js

start-server-core @tanstack/start-server-coreMatch1.167.33js

start-server-core @tanstack/start-server-coreMatch1.167.36js

start-server-core @tanstack/start-server-coreRange1.167.33–1.167.36js

zod-adapter @tanstack/zod-adapterMatch1.166.12js

zod-adapter @tanstack/zod-adapterMatch1.166.15js

zod-adapter @tanstack/zod-adapterRange1.166.12–1.166.15js

vue-router-devtools @tanstack/vue-router-devtoolsMatch1.166.19js

vue-router-devtools @tanstack/vue-router-devtoolsMatch1.166.16js

vue-router-devtools @tanstack/vue-router-devtoolsRange1.166.16–1.166.19js

vue-router @tanstack/vue-routerMatch1.169.5js

vue-router @tanstack/vue-routerMatch1.169.8js

vue-router @tanstack/vue-routerRange1.169.5–1.169.8js

vue-start @tanstack/vue-startMatch1.167.61js

vue-start @tanstack/vue-startMatch1.167.64js

vue-start @tanstack/vue-startRange1.167.61–1.167.64js

vue-router-ssr-query @tanstack/vue-router-ssr-queryMatch1.166.15js

vue-router-ssr-query @tanstack/vue-router-ssr-queryMatch1.166.18js

vue-router-ssr-query @tanstack/vue-router-ssr-queryRange1.166.15–1.166.18js

vue-start-server @tanstack/vue-start-serverMatch1.166.50js

vue-start-server @tanstack/vue-start-serverMatch1.166.53js

vue-start-server @tanstack/vue-start-serverRange1.166.50–1.166.53js

vue-start-client @tanstack/vue-start-clientMatch1.166.46js

vue-start-client @tanstack/vue-start-clientMatch1.166.49js

vue-start-client @tanstack/vue-start-clientRange1.166.46–1.166.49js

Source	Link
github	www.github.com/TanStack/router/issues/7383
socket	www.socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
github	www.github.com/advisories/GHSA-g7cv-rxg3-hmpx
tanstack	www.tanstack.com/blog/npm-supply-chain-compromise-postmortem
github	www.github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
stepsecurity	www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem

01 Aug 2026 11:42Current

6Medium risk

Vulners AI Score6

CVSS 3.19.6

EPSS0.02342

SSVC