Malicious Package Injection in TanStack Products by npm Attackers

CVE-2026-45321

What is CVE-2026-45321?

On May 11, 2026, an attacker exploited multiple vulnerabilities to inject malicious versions of 84 packages across 42 TanStack npm packages. The malicious versions were published using legitimate GitHub Actions, taking advantage of a misconfiguration in pull_request_target workflows and a known cache poisoning flaw. This complex attack allowed the attacker to leverage a trusted identity to distribute malware capable of stealing credentials. Each affected package received two versions with this malicious content shortly after each other, highlighting a significant risk in package management ecosystems.

References