CVE-2026-45321: 
JavaScript vulnerability analysis and mitigation

CVE-2026-45321 is a supply chain compromise affecting 84 malicious versions across 42 @tanstack/* npm packages, classified as Embedded Malicious Code (CWE-506). On May 11, 2026, between approximately 19:20 and 19:26 UTC, an attacker published credential-stealing malware to the npm registry under the legitimate TanStack identity by chaining three GitHub Actions attack techniques. The affected packages span the entire @tanstack/router ecosystem, including @tanstack/react-router, @tanstack/vue-router, @tanstack/solid-router, and dozens of related packages — each receiving exactly two malicious versions. It carries a CVSS v3.1 base score of 9.6 (Critical) (GitHub Advisory, CISA KEV).

The attacker chained three known vulnerability classes to obtain legitimate npm publish credentials without modifying the TanStack publish workflow itself: (1) a pull_request_target "Pwn Request" misconfiguration that allowed a forked PR to trigger privileged workflows, (2) GitHub Actions cache poisoning across the fork↔base trust boundary using a poisoned cache key (Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11), and (3) runtime memory extraction of the GitHub Actions OIDC token from the runner process. The stolen OIDC token was used to publish malicious package versions authenticated via the legitimate trusted-publisher binding. Each malicious package tarball contained an undeclared ~2.3 MB obfuscated payload (router_init.js) at the package root, triggered at install time via a fictitious optional dependency (@tanstack/setup) that resolved to an orphan commit on an attacker-controlled fork, executing bun run tanstack_runner.js && exit 1 — the exit 1 causing npm to silently discard the optional dependency after execution, leaving no node_modules trace (GitHub Advisory).

Any developer or CI/CD environment that ran npm install, pnpm install, or yarn install against an affected @tanstack/* version during the compromise window should be considered fully compromised. The malware harvests AWS IMDS and Secrets Manager credentials, GCP metadata service tokens, Kubernetes service-account tokens, HashiCorp Vault tokens, npm tokens (~/.npmrc), GitHub tokens (environment variables, gh CLI config, .git-credentials), and SSH private keys (~/.ssh/). Exfiltrated data is sent over the Session/Oxen end-to-end encrypted messenger network (filev2.getsession.org, seed{1,2,3}.getsession.org), making content inspection impossible. The malware also self-propagates by enumerating packages the victim maintains on npm and republishing them with the same injection, enabling lateral spread across the npm ecosystem. OpenAI confirmed two employee devices were compromised through the malicious packages, with attackers gaining access to a limited subset of internal source code repositories (GitHub Advisory, CISA KEV).

This vulnerability was actively exploited in the wild on May 11, 2026, and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on May 27, 2026, with a remediation due date of June 10, 2026. The threat actor has been attributed to TeamPCP, the same group behind the broader "Mini Shai-Hulud" npm/PyPI supply chain worm campaign, with associated malware families Shai-Hulud and Mini Shai-Hulud confirmed as weaponizing this CVE. Attacker GitHub accounts zblgg (id 127806521) and voicproducoes (id 269549300) were identified. The EPSS score is approximately 0.041% (Feedly data) though the GitHub Advisory Database reports a 17.051% EPSS score. A detection script (not a real exploit) is publicly available at tanstack-compromise-checker. The attack was first detected by StepSecurity's OSS Package Security Feed (CISA KEV, GitHub Advisory, StepSecurity).

1. Reconnaissance: Identify a target open-source repository (TanStack/router) with a misconfigured pull_request_target GitHub Actions workflow that grants elevated permissions to pull requests from forks.
2. Fork and craft malicious PR: Create a fork of the target repository (attacker accounts: zblgg, voicproducoes) and submit a pull request designed to trigger the privileged pull_request_target workflow.
3. Cache poisoning: Inject a poisoned GitHub Actions cache entry (key: Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11) that crosses the fork↔base trust boundary, causing the base repository's workflow to load attacker-controlled build artifacts.
4. OIDC token extraction: During the compromised workflow run, extract the GitHub Actions OIDC token from the runner process memory — the same technique used in the March 2025 tj-actions/changed-files compromise.
5. Publish malicious packages: Use the stolen OIDC token (trusted-publisher binding oidc:db7d6f54-05d5-412b-8a10-e7a8398b303e) to authenticate to npm and publish 84 malicious versions across 42 @tanstack/* packages between 19:20–19:26 UTC on May 11, 2026.
6. Payload delivery: Each malicious tarball includes an undeclared router_init.js (~2.3 MB obfuscated) at the package root, and a fictitious optionalDependencies entry pointing to an orphan commit on the attacker's fork (github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c).
7. Execution at install time: When a victim runs npm install, npm fetches the orphan commit, runs bun run tanstack_runner.js && exit 1, which executes router_init.js from the host package tarball. The exit 1 causes npm to silently discard the optional dependency.
8. Credential harvesting and exfiltration: router_init.js harvests cloud credentials, tokens, and SSH keys, then exfiltrates them to filev2.getsession.org and seed{1,2,3}.getsession.org over end-to-end encrypted channels.
9. Self-propagation: The malware queries registry.npmjs.org/-/v1/search?text=maintainer:<victim> to enumerate packages the victim maintains and republishes them with the same injection (GitHub Advisory).

• Package Manifest: Presence of the following in any @tanstack/* package.json:

  "optionalDependencies": {
    "@tanstack/setup": "github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c"
  }

• File System: File router_init.js (~2.3 MB) present at the package tarball root (not declared in the files array); file tanstack_runner.js in the orphan commit.
• Network: Outbound connections to filev2.getsession.org, seed1.getsession.org, seed2.getsession.org, seed3.getsession.org from developer workstations or CI runners; requests to https://litter.catbox.moe/h8nc9u.js or https://litter.catbox.moe/7rrc6l.mjs.
• GitHub Actions: Workflow runs https://github.com/TanStack/router/actions/runs/25613093674 (attempt 4) and https://github.com/TanStack/router/actions/runs/25691781302; poisoned cache key Linux-pnpm-store-6f9233a50def742c09fde54f56553d6b449a535adf87d4083690539f49ae4da11.
• npm Registry: Packages published by attacker GitHub accounts zblgg (id 127806521) or voicproducoes (id 269549300); use of OIDC publisher oidc:db7d6f54-05d5-412b-8a10-e7a8398b303e during the window 2026-05-11 19:20–19:26 UTC.
• Process: Unexpected bun process execution during npm install; npm install spawning network connections to Session/Oxen infrastructure.
• Cloud Audit Logs: Unusual API calls to AWS IMDS (169.254.169.254), GCP metadata service, or Kubernetes API server originating from developer machines or CI runners during or after the install window (GitHub Advisory).

Immediate actions: Any environment that ran npm install, pnpm install, or yarn install against an affected @tanstack/* version on May 11, 2026 between 19:20–19:26 UTC should be treated as compromised — rotate all credentials accessible to the install process immediately, including cloud credentials, npm tokens, GitHub tokens, and SSH keys. Review cloud audit logs for anomalous activity from affected hosts.

Patching: Update all affected @tanstack/* packages to the patched versions listed in the advisory (e.g., @tanstack/react-router → 1.169.9, @tanstack/router-core → 1.169.9, etc.). Delete node_modules and the lockfile, then reinstall from a clean state.

Workarounds (if immediate upgrade is not possible):

• Pin all @tanstack/* dependencies to versions published before 2026-05-11 19:00 UTC (last known-good versions were published 2026-03-15).
• Set npm config set ignore-scripts true as a temporary defense-in-depth measure.
• Audit GitHub Actions workflows for pull_request_target misconfigurations and implement cache isolation between fork and base repositories.
• Use a detection script such as tanstack-compromise-checker to scan local projects and CI environments (GitHub Advisory, CISA KEV).

The TanStack team published a detailed postmortem at tanstack.com/blog/npm-supply-chain-compromise-postmortem acknowledging the attack chain and timeline. StepSecurity, which first detected the attack via its OSS Package Security Feed, published a blog post tracking the spread of the "Mini Shai-Hulud" worm across the npm ecosystem (StepSecurity). Snyk published a detailed technical analysis of the compromise (Snyk Blog), and Semgrep released a campaign analysis titled "Children of Shai-Hulud" covering the evolution and spread of the attack. The Hacker News, VentureBeat, and Security Boulevard covered the incident extensively, noting that OpenAI confirmed two employee devices were compromised and that the company rotated code-signing certificates in response. CISA added the vulnerability to its KEV catalog on May 27, 2026, and issued an alert. The community reaction was significant, with multiple detection tools published on GitHub within 24 hours of disclosure and active discussion on Reddit, Bluesky, and developer forums about the implications for npm supply chain security and GitHub Actions hardening.