What is this vulnerability?

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

How it works

This is classified as CWE-506. In plain terms, an attacker could use this flaw in TanStack to gain access, disrupt service, or steal data — the exact impact depends on how it’s deployed in your environment.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Mitigations

• Apply the vendor’s security patch or update as soon as it’s available and tested.
• If no patch exists yet, apply the vendor’s temporary workaround.
• Limit network exposure of the affected system until it’s patched.
• Review logs for signs of prior exploitation, especially if it’s flagged for ransomware use.

Recommendations

• Confirm whether TanStack TanStack is used anywhere in your environment.
• Patch internet-facing systems first, then internal ones.
• Set a reminder ahead of the remediation deadline so it doesn’t slip.
• Subscribe to the vendor’s security advisories for earlier warning next time.