Malicious Package Injection in TanStack Products by npm Attackers

CVE-2026-45321

What is CVE-2026-45321?

CVE-2026-45321 is a significant vulnerability affecting various TanStack products that utilize the npm package registry. This vulnerability arises from a malicious package injection attack where unauthorized versions of TanStack packages were published to npm, exploiting a combination of three established vulnerability classes. The attackers leveraged GitHub Actions misconfigurations and memory extraction techniques to publish malware disguised as legitimate packages. This could severely impact organizations using TanStack products by compromising the integrity of their software supply chain, allowing malicious actors to execute credential-stealing actions, which could result in unauthorized access to sensitive information and potentially lead to larger systemic compromises.

Potential impact of CVE-2026-45321

1. Credential Theft: The malicious packages contain malware designed to extract sensitive credentials from systems that utilize the affected TanStack products. This could lead to unauthorized access to user data and organizational resources.

2. Supply Chain Compromise: By injecting malicious versions of trusted packages, attackers can undermine the integrity of the software supply chain, affecting not just immediate targets but also downstream users who rely on these packages, leading to widespread vulnerability propagation.

3. System Compromise: Deployment of the infected packages can enable attackers to gain control over affected systems, establishing them as footholds for further exploitation or lateral movement within an organization's network, increasing the risk of data breaches and ransomware attacks.

References