Description
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified.
Recommendation
Update the @tanstack/vue-router package to the latest compatible version. Followings are version details:
Affected version(s): **= 1.169.8 = 1.169.5** - Patched version(s): 1.169.9
References
Could your website be exposed too?
SmartScanner can check your website for Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/vue-router and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/vue-router-ssr-query - CVE-2026-45321
- Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/vue-router-devtools - CVE-2026-45321
- Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-router-devtools - CVE-2026-45321
- Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-router-ssr-query - CVE-2026-45321
You might also like:
See something that needs correcting? Let us knowUpdated June 08, 2026