# CVE-2026-45321: TanStack Unspecified > Attackers published malicious versions of TanStack npm packages to steal cloud credentials, GitHub tokens, and SSH keys from users installing them. - **Severity:** Critical 9.6 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`) - **Exploited in the wild:** Yes, since 27 May 2026 (CISA KEV), used in ransomware - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 12 May 2026 - **Updated:** 4 Aug 2026 - **Also known as:** GHSA-g7cv-rxg3-hmpx ## What is CVE-2026-45321? CVE-2026-45321 is a critical vulnerability in @tanstack arktype-adapter, published on 12 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link. ### Official description On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart. Weakness: CWE-506 (Embedded Malicious Code) ## Which versions are affected by CVE-2026-45321? 40 open source packages ship an affected version, including @tanstack/arktype-adapter, @tanstack/eslint-plugin-router and @tanstack/eslint-plugin-start. It affects 171 products. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `@tanstack/arktype-adapter` | npm | From 1.166.12 | 1.166.16 | | `@tanstack/arktype-adapter` | npm | From 1.166.12 | 1.166.16 | | `@tanstack/arktype-adapter` | npm | From 1.166.15 | 1.166.16 | | `@tanstack/arktype-adapter` | npm | From 1.166.15 | 1.166.16 | | `@tanstack/eslint-plugin-router` | npm | From 1.161.12 | 1.161.13 | | `@tanstack/eslint-plugin-router` | npm | From 1.161.12 | 1.161.13 | | `@tanstack/eslint-plugin-router` | npm | From 1.161.9 | 1.161.13 | | `@tanstack/eslint-plugin-router` | npm | From 1.161.9 | 1.161.13 | | `@tanstack/eslint-plugin-start` | npm | From 0.0.4 | 0.0.8 | | `@tanstack/eslint-plugin-start` | npm | From 0.0.4 | 0.0.8 | | `@tanstack/eslint-plugin-start` | npm | From 0.0.7 | 0.0.8 | | `@tanstack/eslint-plugin-start` | npm | From 0.0.7 | 0.0.8 | | `@tanstack/history` | npm | From 1.161.12 | 1.161.13 | | `@tanstack/history` | npm | From 1.161.12 | 1.161.13 | | `@tanstack/history` | npm | From 1.161.9 | 1.161.13 | | `@tanstack/history` | npm | From 1.161.9 | 1.161.13 | | `@tanstack/nitro-v2-vite-plugin` | npm | From 1.154.12 | 1.154.16 | | `@tanstack/nitro-v2-vite-plugin` | npm | From 1.154.12 | 1.154.16 | | `@tanstack/nitro-v2-vite-plugin` | npm | From 1.154.15 | 1.154.16 | | `@tanstack/nitro-v2-vite-plugin` | npm | From 1.154.15 | 1.154.16 | | `@tanstack/react-router` | npm | From 1.169.5 | 1.169.9 | | `@tanstack/react-router` | npm | From 1.169.5 | 1.169.9 | | `@tanstack/react-router` | npm | From 1.169.8 | 1.169.9 | | `@tanstack/react-router` | npm | From 1.169.8 | 1.169.9 | | `@tanstack/react-router-devtools` | npm | From 1.166.16 | 1.166.20 | | `@tanstack/react-router-devtools` | npm | From 1.166.16 | 1.166.20 | | `@tanstack/react-router-devtools` | npm | From 1.166.19 | 1.166.20 | | `@tanstack/react-router-devtools` | npm | From 1.166.19 | 1.166.20 | | `@tanstack/react-router-ssr-query` | npm | From 1.166.15 | 1.166.19 | | `@tanstack/react-router-ssr-query` | npm | From 1.166.15 | 1.166.19 | | `@tanstack/react-router-ssr-query` | npm | From 1.166.18 | 1.166.19 | | `@tanstack/react-router-ssr-query` | npm | From 1.166.18 | 1.166.19 | | `@tanstack/react-start` | npm | From 1.167.68 | 1.167.72 | | `@tanstack/react-start` | npm | From 1.167.68 | 1.167.72 | | `@tanstack/react-start` | npm | From 1.167.71 | 1.167.72 | | `@tanstack/react-start` | npm | From 1.167.71 | 1.167.72 | | `@tanstack/react-start-client` | npm | From 1.166.51 | 1.166.55 | | `@tanstack/react-start-client` | npm | From 1.166.51 | 1.166.55 | | `@tanstack/react-start-client` | npm | From 1.166.54 | 1.166.55 | | `@tanstack/react-start-client` | npm | From 1.166.54 | 1.166.55 | Products: Abhishake1 Supersurkhet\/Cli, Abhishake1 Supersurkhet\/Sdk, Abhishake1 Taskflow-Corp\/Cli, Agentworkhq Agentwork-Cli, Antoinebcx Ml-Toolkit-Ts, Antoinebcx Ml-Toolkit-Ts\/Preprocessing, Antoinebcx Ml-Toolkit-Ts\/Xgboost, Beproduct Beproduct\/Nestjs-Auth, Christianalares Git-Git-Git, Christianalares Git Branch Selector, Christianalares Nextmove-Mcp, Christianalares Tolka\/Cli, Dirigible Dirigible-Ai\/Sdk, Guardrailsai Guardrails Ai, Kilbot Tallyui\/Components, Kilbot Tallyui\/Connector-Medusa, Kilbot Tallyui\/Connector-Shopify, Kilbot Tallyui\/Connector-Vendure, Kilbot Tallyui\/Connector-Woocommerce, Kilbot Tallyui\/Core and 151 more. ## How do I fix CVE-2026-45321? Upgrade @tanstack/arktype-adapter to 1.166.16 or later. US federal agencies must fix it by 10 Jun 2026. ## Is CVE-2026-45321 being exploited? Yes. Attackers have exploited CVE-2026-45321 in the wild since at least 27 May 2026, including in ransomware campaigns. Public exploit code: - Scanner for the Mini Shai-Hulud npm/PyPI supply chain worm (NHS CC-4781 · CVE-2026-45321). Detects gh-token-monitor persistence, payload artefacts, and attacker commits. Python, Bash, PowerShell. (github_poc): https://github.com/Intrudify/mini-shai-hulud-scanner - Shell script to detect TanStack npm supply chain attack indicators (CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx) (github_poc): https://github.com/fabriziosalmi/tanstack-compromise-checker - Detect CVE-2026-45321 Mini Shai-Hulud supply chain compromise — scans for 170 npm + 2 PyPI poisoned packages across TanStack, Mistral AI, UiPath, OpenSearch, Guardrails AI (github_poc): https://github.com/qi-scape/scan-shai-hulud - Claude Code skill to scan machines for Mini Shai-Hulud (CVE-2026-45321) supply chain worm IOCs (github_poc): https://github.com/shayr1/shai-hulud-scan - IOC checker for the TanStack/Mini Shai-Hulud npm supply chain attack (CVE-2026-45321) (github_poc): https://github.com/nkopylov/tanscript-exploit-check - Detects CVE-2026-45321 (TanStack supply chain compromise) and Mini Shai-Hulud worm artifacts. Scans node_modules, lockfiles, persistence hooks (Claude Code, VS Code, systemd, LaunchAgent), GitHub workflows, git history, C2 domains, and AI tool configs. (github_poc): https://github.com/ry-allan/tanstack-compromise-checker ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-45321 and fix it if it is affected. What it is: CVE-2026-45321 is a critical vulnerability in @tanstack arktype-adapter, published on 12 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link. Exploitation: Yes. Attackers have exploited CVE-2026-45321 in the wild since at least 27 May 2026, including in ransomware campaigns. Affected packages and fixed versions: - @tanstack/arktype-adapter (npm): affected from 1.166.12; fixed in 1.166.16 - @tanstack/arktype-adapter (npm): affected from 1.166.12; fixed in 1.166.16 - @tanstack/arktype-adapter (npm): affected from 1.166.15; fixed in 1.166.16 - @tanstack/arktype-adapter (npm): affected from 1.166.15; fixed in 1.166.16 - @tanstack/eslint-plugin-router (npm): affected from 1.161.12; fixed in 1.161.13 - @tanstack/eslint-plugin-router (npm): affected from 1.161.12; fixed in 1.161.13 - @tanstack/eslint-plugin-router (npm): affected from 1.161.9; fixed in 1.161.13 - @tanstack/eslint-plugin-router (npm): affected from 1.161.9; fixed in 1.161.13 - @tanstack/eslint-plugin-start (npm): affected from 0.0.4; fixed in 0.0.8 - @tanstack/eslint-plugin-start (npm): affected from 0.0.4; fixed in 0.0.8 - @tanstack/eslint-plugin-start (npm): affected from 0.0.7; fixed in 0.0.8 - @tanstack/eslint-plugin-start (npm): affected from 0.0.7; fixed in 0.0.8 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-45321/ (Markdown: https://insights.sbomify.com/CVE-2026-45321/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-45321 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45321 - OSV: https://osv.dev/vulnerability/CVE-2026-45321 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-45321/ Summaries are generated and may contain mistakes; the official description above is the record.