Article
TanStack worm: CI questions every team should ask
The TanStack npm worm chained a risky workflow, cache poisoning and a short-lived token. See the CI and monitoring questions a security lead should…
Read more
Exploited vulnerability
TanStack npm packages compromise (CVE-2026-45321)
Not a flaw in TanStack's router code.
- On CISA KEV
- CVE ID
- CVE-2026-45321
- CISA KEV
- Listed
- Affected product
- @tanstack/* npm packages (Router and Start families)
- Exploited
- Yes
- Published
- May 2026
In short
CVE-2026-45321 is not a flaw in TanStack's router code. It is the number given to 84 malicious versions of 42 TanStack packages that an attacker published to the npm registry on 11 May 2026 under the project's own trusted identity. CISA lists it as an exploited vulnerability that let credential-stealing malware be published.
- CVECVE-2026-45321
- ProductTanStack @tanstack/* npm packages (Router and Start families)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedHarden installs · Block the exfiltration hosts
What it allows
Anyone who installed an affected version ran a hidden 2.3 MB script at install time. It harvested AWS, Google Cloud, Kubernetes, Vault, npm and GitHub credentials and SSH keys, and sent them out over the Session messenger network. It also looked up other npm packages the victim maintains and republished them with the same code. The CVSS v3.1 score is 9.6 (supplied by GitHub, which assigned the record). NVD shows no score of its own.
Our post TanStack npm worm: CI questions for security teams covers what to ask about your own pipelines. A different npm risk comes from a build tool instead of a poisoned package: see the openapi-typescript-codegen build-tool flaw (CVE-2026-108551).
Who is affected
Per the GitHub advisory, 84 versions across 42 @tanstack packages, two per package, published between about 19:20 and 19:26 UTC on 11 May 2026. For example, @tanstack/react-router 1.169.5 and 1.169.8 are bad and 1.169.9 is the patched version. The maintainers say the Query, Table, Form and Virtual families were not affected. Any machine or build that installed an affected version on 11 May 2026 should be treated as compromised.
First exploitation, as the advisory states it: 11 May 2026, 19:20 to 19:26 UTC. The attacker chained three known weaknesses: a risky pull request workflow, a poisoned build cache and a short-lived publishing token pulled from the build runner's memory. The publish workflow itself was not changed, so the packages looked genuine. Per the Nx advisory, the same incident leaked a developer's GitHub token that was then used for the Nx Console compromise a week later.
NVD published the record on 12 May 2026; the CISA entry added later lists exploitation as active. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 27 May 2026 with a due date of 10 June 2026. The KEV entry flags known ransomware campaign use as Known. The advisory, the postmortem and the CISA entry cited here tie it to no ransomware group or attack.
Attributed by CERT-EU, 2 June 2026, to the threat actor TeamPCP, in its Cyber Brief for May 2026. CERT-EU calls the worm Mini Shai-Hulud and says it affected ecosystems tied to TanStack and other open-source projects. The GitHub advisory and the NVD record name no actor.
Timeline
- 11 May 2026
Malicious versions published. The GitHub advisory says 84 versions of 42 @tanstack packages went to npm between about 19:20 and 19:26 UTC, under the project's own trusted identity.
- 12 May 2026
NVD record published. NVD publishes CVE-2026-45321.
- 27 May 2026
Added to CISA KEV. CISA adds the flaw to the Known Exploited Vulnerabilities catalog with a due date of 10 June 2026.
- 2 June 2026
Attribution by CERT-EU. CERT-EU attributes the worm it calls Mini Shai-Hulud to the threat actor TeamPCP in its Cyber Brief for May 2026.
Who exploits it
- Malware Mini Shai-Hulud Mini Shai-Hulud is a credential stealer and self-replicating worm that spreads through software packages and build pipelines. Infostealer · Since 2026 · Containers, IaaS, Linux, macOS, SaaS, Windows
- Threat group TeamPCP The US FBI (July 2026) describes TeamPCP as a cyber criminal group behind large-scale software supply chain compromises of widely used developer and security tools. Since 2025
Seen in
- Incident Nx Console extension and GitHub repositories breach On 18 May 2026 an attacker published a malicious version 18.95.0 of the Nx Console extension for VS Code, using a real Nx contributor's identity. May 2026 · Technology and software supply chain
- Incident TanStack npm worm (Mini Shai-Hulud) The TanStack npm worm, also called Mini Shai-Hulud, was a supply chain attack. May 2026 · Technology and software supply chain
What to do
-
Find and remove affected versions
Search lockfiles, caches and mirrors for the versions in the GitHub advisory. Update each package to the patched version it lists, delete node_modules and the lockfile, and reinstall.
-
Treat exposed hosts as compromised
The advisory says anything that installed an affected version on 11 May 2026 is compromised, and all credentials reachable by the install should be rotated at once. Review cloud audit logs for activity from those hosts.
-
Harden installs
Until clean releases are in use, the advisory suggests pinning TanStack packages to versions from before 11 May 2026 19:00 UTC and setting npm to skip install scripts. Audit CI pipelines that installed during the window.
-
Block the exfiltration hosts
The advisory says the stolen data goes to an encrypted network with no attacker-run server, so blocking by IP or domain is the only network control. It lists filev2.getsession.org and seed1, seed2 and seed3.getsession.org.
-
Detect and hunt
Inspect a package's manifest without running scripts (npm pack, then read package.json). A bad one lists an optional dependency named @tanstack/setup pointing to a GitHub commit, and ships a file named router_init.js of about 2.3 MB at the package root.
Questions
What is CVE-2026-45321?
It is the number given to 84 malicious versions of 42 TanStack npm packages that an attacker published on 11 May 2026 under the project's own trusted identity. It is not a flaw in TanStack's router code.
What does the TanStack npm compromise steal?
The hidden script ran at install time and harvested AWS, Google Cloud, Kubernetes, Vault, npm and GitHub credentials and SSH keys. It sent them out over the Session messenger network and republished other npm packages the victim maintains.
Which TanStack packages were affected?
Per the GitHub advisory, 84 versions across 42 @tanstack packages were affected, two per package. The maintainers say the Query, Table, Form and Virtual families were not affected. For example, @tanstack/react-router 1.169.9 is the patched version.
What should I do if I installed an affected TanStack version?
Treat any machine or build that installed an affected version on 11 May 2026 as compromised. Move to a patched version and rotate the cloud, npm and GitHub credentials and SSH keys that were reachable from it.
Is CVE-2026-45321 exploited in the wild?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 27 May 2026 with a due date of 10 June 2026. CERT-EU attributes the wider worm activity to the threat actor TeamPCP.
In our research
- TanStack worm: CI questions every team should ask October 2026
- TeamPCP Threat group
Sources
- Malware in 42 @tanstack/* packages (GHSA-g7cv-rxg3-hmpx) TanStack, via GitHub Advisory Database
- Postmortem: TanStack npm supply-chain compromise TanStack
- CVE-2026-45321 record NIST NVD
- Known Exploited Vulnerabilities catalog CISA
- Cyber Brief 26-06, May 2026 CERT-EU
- Compromised Nx Console version 18.95.0 (GHSA-c9j4-9m59-847w) Nx, via GitHub Advisory Database
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 151 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.