{"items":[{"id":"NVI-00000342","kind":"vulnerability","title":"Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","CISA catalog date-added and due-date fields are not the original vulnerability disclosure date or universal legal deadlines.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-g7cv-rxg3-hmpx","CVE-2026-45321"],"plain_summary":"GitHub lists this reviewed advisory for @tanstack/arktype-adapter, @tanstack/eslint-plugin-router, @tanstack/eslint-plugin-start, @tanstack/history, @tanstack/nitro-v2-vite-plugin. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0c8ad7a2cbf7be31408734a9ffe6223d"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","source_ids":["sr-2fd07a4ae369cdb1a230af66f0719cc9"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-08T23:53:12.000Z","value":"9.6 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-0878f38d08f275a8cf5a156abe935897"},{"kind":"CISA_KEV","as_of":"2026-05-27T00:00:00.000Z","value":"Listed","meaning":"CISA lists known exploitation. This does not establish exploitation of your system.","source_id":"sr-2fd07a4ae369cdb1a230af66f0719cc9"},{"kind":"CVSS","as_of":"2026-10-26T18:10:00.173Z","value":"9.6 CRITICAL (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-eb4a780057a9c9314a85d07cab6c5d10"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"3.278%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.88427. Missing scores are unknown.","source_id":"sr-0c8ad7a2cbf7be31408734a9ffe6223d"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0878f38d08f275a8cf5a156abe935897","url":"https://github.com/advisories/GHSA-g7cv-rxg3-hmpx","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-g7cv-rxg3-hmpx","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:50:36.189Z"},{"id":"sr-2fd07a4ae369cdb1a230af66f0719cc9","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","basis":"official_catalog","notes":"CISA KEV; CC0 1.0. Catalog assertions are not evidence of customer compromise.","title":"CVE-2026-45321","publisher":"CISA","observed_at":"2026-10-31T20:54:12.600Z"},{"id":"sr-eb4a780057a9c9314a85d07cab6c5d10","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45321","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-45321","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T21:43:56.566Z"},{"id":"sr-0c8ad7a2cbf7be31408734a9ffe6223d","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-45321","publisher":"FIRST EPSS","observed_at":"2026-10-31T21:41:13.231Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/arktype-adapter","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.12"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/eslint-plugin-router","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.161.9"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/eslint-plugin-start","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 0.0.4"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/history","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.161.9"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/nitro-v2-vite-plugin","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.154.12"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-router","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.169.5"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-router-devtools","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.16"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-router-ssr-query","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.15"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-start","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.167.68"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-start-client","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.51"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-start-rsc","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 0.0.47"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-start-server","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.55"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-cli","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.46"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-core","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.169.5"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-devtools","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.16"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-devtools-core","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.167.6"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-generator","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.45"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-plugin","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.167.38"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-ssr-query-core","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.168.3"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-utils","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.161.11"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-vite-plugin","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.53"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/solid-router","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.169.5"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/solid-router-devtools","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.16"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/solid-router-ssr-query","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.15"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/solid-start","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.167.65"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/solid-start-client","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.50"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/solid-start-server","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.54"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/start-client-core","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.168.5"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/start-fn-stubs","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.161.9"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/start-plugin-core","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.169.23"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/start-server-core","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.167.33"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/start-static-server-functions","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.44"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/start-storage-context","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.38"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/valibot-adapter","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.12"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/virtual-file-routes","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.161.10"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/vue-router","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.169.5"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/vue-router-devtools","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.16"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/vue-router-ssr-query","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.15"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/vue-start","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.167.61"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/vue-start-client","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.46"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/vue-start-server","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.50"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/zod-adapter","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.12"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/arktype-adapter","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.15"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/eslint-plugin-router","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.161.12"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/eslint-plugin-start","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 0.0.7"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/history","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.161.12"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/nitro-v2-vite-plugin","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.154.15"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-router","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.169.8"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-router-devtools","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.19"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-router-ssr-query","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.18"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-start","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.167.71"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-start-client","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.54"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-start-rsc","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 0.0.50"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/react-start-server","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.58"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-cli","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.49"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-core","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.169.8"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-devtools","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.19"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-devtools-core","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.167.9"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-generator","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.48"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-plugin","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.167.41"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-ssr-query-core","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.168.6"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-utils","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.161.14"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/router-vite-plugin","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.56"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/solid-router","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.169.8"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/solid-router-devtools","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.19"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/solid-router-ssr-query","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.18"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/solid-start","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.167.68"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/solid-start-client","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.53"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/solid-start-server","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.57"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/start-client-core","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.168.8"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/start-fn-stubs","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.161.12"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/start-plugin-core","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.169.26"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/start-server-core","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.167.36"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/start-static-server-functions","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.47"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/start-storage-context","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.41"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/valibot-adapter","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.15"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/virtual-file-routes","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.161.13"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/vue-router","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.169.8"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/vue-router-devtools","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.19"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/vue-router-ssr-query","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.18"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/vue-start","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.167.64"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/vue-start-client","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.49"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/vue-start-server","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.53"]},{"certainty":"source_listed","source_ids":["sr-0878f38d08f275a8cf5a156abe935897"],"technology":"@tanstack/zod-adapter","known_exclusions":[],"conditions_summary":"## Summary\n\nOn 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for `TanStack/router`, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a `pull_request_target` \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity.\n\nEach affected package received exactly two malicious versions, published a few minutes apart.\n\n## Impact\n\nA user installing any affected version executes a payload (~2.3 MB obfuscated `router_init.js`) at install time that:\n\n- Harvests credentials from common locations:\n  - AWS instance metadata (IMDS) and Secrets Manager\n  - GCP metadata service\n  - Kubernetes service-account tokens\n  - HashiCorp Vault tokens\n  - `~/.npmrc` (npm tokens)\n  - GitHub tokens (env vars, `gh` CLI config, `.git-credentials`)\n  - SSH private keys (`~/.ssh/`","public_affected_ranges":["= 1.166.15"]},{"certainty":"source_listed","source_ids":["sr-2fd07a4ae369cdb1a230af66f0719cc9"],"technology":"TanStack TanStack","known_exclusions":[],"conditions_summary":"CISA does not supply a complete application-specific affected range here. Follow the linked vendor advisory for version and configuration prerequisites.","public_affected_ranges":[]}],"null_published_at":"2026-11-07T07:07:39.803Z","source_updated_at":"2026-06-08T23:53:12.000Z","source_disclosed_at":"2026-05-12T00:12:49.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T20:54:12.600Z"},{"id":"NVI-00000342","kind":"vulnerability","title":"TanStack Unspecified Vulnerability","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","CISA catalog date-added and due-date fields are not the original vulnerability disclosure date or universal legal deadlines.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["CVE-2026-45321"],"plain_summary":"CISA lists CVE-2026-45321 in its Known Exploited Vulnerabilities catalog. The catalog names TanStack TanStack; it does not establish that a particular visitor is exposed or compromised.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","source_ids":["sr-2fd07a4ae369cdb1a230af66f0719cc9"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0c8ad7a2cbf7be31408734a9ffe6223d"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CISA_KEV","as_of":"2026-05-27T00:00:00.000Z","value":"Listed","meaning":"CISA lists known exploitation. This does not establish exploitation of your system.","source_id":"sr-2fd07a4ae369cdb1a230af66f0719cc9"},{"kind":"CVSS","as_of":"2026-10-26T18:10:00.173Z","value":"9.6 CRITICAL (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-eb4a780057a9c9314a85d07cab6c5d10"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"3.278%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.88427. Missing scores are unknown.","source_id":"sr-0c8ad7a2cbf7be31408734a9ffe6223d"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2fd07a4ae369cdb1a230af66f0719cc9","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","basis":"official_catalog","notes":"CISA KEV; CC0 1.0. Catalog assertions are not evidence of customer compromise.","title":"CVE-2026-45321","publisher":"CISA","observed_at":"2026-10-31T20:54:12.600Z"},{"id":"sr-eb4a780057a9c9314a85d07cab6c5d10","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45321","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-45321","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T21:43:56.566Z"},{"id":"sr-0c8ad7a2cbf7be31408734a9ffe6223d","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-45321","publisher":"FIRST EPSS","observed_at":"2026-10-31T21:41:13.231Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2fd07a4ae369cdb1a230af66f0719cc9"],"technology":"TanStack TanStack","known_exclusions":[],"conditions_summary":"CISA does not supply a complete application-specific affected range here. Follow the linked vendor advisory for version and configuration prerequisites.","public_affected_ranges":[]}],"null_published_at":"2026-10-31T22:12:43.452Z","source_updated_at":"2026-05-27T00:00:00.000Z","source_disclosed_at":null,"is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T20:54:12.600Z"},{"id":"NVI-00000342","kind":"vulnerability","title":"TanStack Unspecified Vulnerability","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","CISA catalog date-added and due-date fields are not the original vulnerability disclosure date or universal legal deadlines."],"lifecycle":"active","identifiers":["CVE-2026-45321"],"plain_summary":"CISA lists CVE-2026-45321 in its Known Exploited Vulnerabilities catalog. The catalog names TanStack TanStack; it does not establish that a particular visitor is exposed or compromised.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","source_ids":["sr-2fd07a4ae369cdb1a230af66f0719cc9"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CISA_KEV","as_of":"2026-05-27T00:00:00.000Z","value":"Listed","meaning":"CISA lists known exploitation. This does not establish exploitation of your system.","source_id":"sr-2fd07a4ae369cdb1a230af66f0719cc9"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2fd07a4ae369cdb1a230af66f0719cc9","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","basis":"official_catalog","notes":"CISA KEV; CC0 1.0. Catalog assertions are not evidence of customer compromise.","title":"CVE-2026-45321","publisher":"CISA","observed_at":"2026-10-31T20:54:12.600Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2fd07a4ae369cdb1a230af66f0719cc9"],"technology":"TanStack TanStack","known_exclusions":[],"conditions_summary":"CISA does not supply a complete application-specific affected range here. Follow the linked vendor advisory for version and configuration prerequisites.","public_affected_ranges":[]}],"null_published_at":"2026-10-31T21:27:33.471Z","source_updated_at":"2026-05-27T00:00:00.000Z","source_disclosed_at":null,"is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T20:54:12.600Z"}],"next_cursor":null,"snapshot_revision":"42594"}