TanStack npm Packages Supply Chain Compromise via GitHub Actions OIDC Exploitation (CVE-2026-45321)
Executive & SecOps Summary
SECOPS ASSESSMENT84 malicious versions across 42 @tanstack/* packages published between 19:20 and 19:26 UTC on 2026-05-11
Attackers successfully published credential-stealing malware under trusted identities by hijacking legitimate OIDC tokens
Immediately audit dependency trees, purge affected package versions, and rotate all potentially exposed credentials
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Audit and Force Update Dependencies
Inspect your project's lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) for any @tanstack/* packages resolved during the compromise window and force-upgrade them.
# For npm users
npm cache clean --force
npm install @tanstack/react-router@latest
# For yarn users
yarn cache clean
yarn upgrade @tanstack/react-router --latest2. Revoke and Rotate Credentials
Any secrets, API keys, database credentials, or cloud provider tokens (AWS, GCP, Azure) that were present in environments where the malicious packages were executed must be treated as compromised and rotated immediately.
3. Harden GitHub Actions Workflows
To prevent similar OIDC and cache poisoning attacks, restrict permissions for the pull_request_target event and enforce strict token permissions.
# Example of hardening workflow permissions
permissions:
contents: read
id-token: write # Limit OIDC token generation strictly to trusted release jobsScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
This vulnerability represents a highly sophisticated supply chain compromise targeting the TanStack ecosystem's CI/CD pipeline. The attacker chained three distinct vulnerability classes to bypass standard security controls:
- Pwn Request (pull_request_target Misconfiguration): Exploited permissive workflow triggers that allowed untrusted code from pull requests to run in a privileged context.
- GitHub Actions Cache Poisoning: Injected malicious payloads across the fork-to-base trust boundary via shared cache mechanisms.
- Runtime Memory Extraction: Extracted the active OIDC (OpenID Connect) trusted-publisher token directly from the memory of the running Actions runner process.
By leveraging the extracted OIDC token, the attacker authenticated directly to the npm registry as a legitimate publisher, uploading malware designed to harvest sensitive credentials without modifying the repository's codebase.
Official Vendor Advisories & References
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.