TanStack Unspecified Vulnerability

Summary

TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.

Remediation

1. Inventory every TanStack TanStack deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.
3. Review logs from before the change for signs of exploitation.

References

• Advisoryhttps://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
• Advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-45321
• Referencehttps://github.com/TanStack/router/issues/7383
• Referencehttps://tanstack.com/blog/npm-supply-chain-compromise-postmortem
• Referencehttps://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem
• Referencehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321