On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pullrequesttarget "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
{
"unresolved_ranges": [
{
"source": "AFFECTED_FIELD",
"extracted_events": [
{
"introduced": "1.161.9"
},
{
"last_affected": "1.161.9"
},
{
"introduced": "1.161.12"
},
{
"last_affected": "1.161.12"
},
{
"introduced": "1.161.9"
},
{
"last_affected": "1.161.9"
},
{
"introduced": "1.161.12"
},
{
"last_affected": "1.161.12"
},
{
"introduced": "1.154.15"
},
{
"last_affected": "1.154.15"
},
{
"introduced": "1.167.68"
},
{
"last_affected": "1.167.68"
},
{
"introduced": "1.167.71"
},
{
"last_affected": "1.167.71"
},
{
"introduced": "1.166.54"
},
{
"last_affected": "1.166.54"
},
{
"introduced": "0.0.47"
},
{
"last_affected": "0.0.47"
},
{
"introduced": "0.0.50"
},
{
"last_affected": "0.0.50"
},
{
"introduced": "1.166.55"
},
{
"last_affected": "1.166.55"
},
{
"introduced": "1.166.58"
},
{
"last_affected": "1.166.58"
},
{
"introduced": "1.161.11"
},
{
"last_affected": "1.161.11"
},
{
"introduced": "1.161.14"
},
{
"last_affected": "1.161.14"
},
{
"introduced": "1.166.53"
},
{
"last_affected": "1.166.53"
},
{
"introduced": "1.166.56"
},
{
"last_affected": "1.166.56"
},
{
"introduced": "1.167.68"
},
{
"last_affected": "1.167.68"
},
{
"introduced": "1.166.53"
},
{
"last_affected": "1.166.53"
},
{
"introduced": "1.166.54"
},
{
"last_affected": "1.166.54"
},
{
"introduced": "1.166.57"
},
{
"last_affected": "1.166.57"
},
{
"introduced": "1.161.9"
},
{
"last_affected": "1.161.9"
},
{
"introduced": "1.161.12"
},
{
"last_affected": "1.161.12"
},
{
"introduced": "1.169.23"
},
{
"last_affected": "1.169.23"
},
{
"introduced": "1.169.26"
},
{
"last_affected": "1.169.26"
},
{
"introduced": "1.161.10"
},
{
"last_affected": "1.161.10"
},
{
"introduced": "1.161.13"
},
{
"last_affected": "1.161.13"
},
{
"introduced": "1.166.53"
},
{
"last_affected": "1.166.53"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45321.json",
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-506"
]
}{
"source": "CPE_STRING",
"cpe": [
"cpe:2.3:a:neilcochran:squawk\\/airports:0.6.2:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/airspace-data:0.5.4:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/airway-data:0.5.4:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/airways:0.4.2:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/airways:0.4.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/fix-data:0.6.4:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/flight-math:0.5.4:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/geo:0.4.4:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/geo:0.4.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/navaid-data:0.6.4:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/navaids:0.4.2:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/navaids:0.4.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/units:0.4.4:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/airports:0.6.3:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/airway-data:0.5.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/fixes:0.3.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/flight-math:0.5.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/flightplan:0.5.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/icao-registry:0.5.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/procedure-data:0.7.3:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/procedures:0.5.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/airspace:0.8.1:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/types:0.8.1:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:wot-api:0.8.1:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/airspace:0.8.2:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/types:0.8.2:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:wot-api:0.8.2:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/airspace:0.8.4:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/airways:0.4.3:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/flightplan:0.5.2:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/icao-registry:0.5.2:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/icao-registry-data:0.8.4:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/navaids:0.4.3:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/procedures:0.5.2:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/types:0.8.4:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/units:0.4.3:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:wot-api:0.8.4:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/airspace-data:0.5.3:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/flightplan:0.5.3:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/icao-registry:0.5.3:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/icao-registry-data:0.8.7:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/procedures:0.5.3:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/airway-data:0.5.7:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/fix-data:0.6.7:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/flight-math:0.5.7:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/geo:0.4.7:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/navaid-data:0.6.7:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/notams:0.3.7:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/weather:0.5.7:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/weather:0.5.9:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/fixes:0.3.2:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/fixes:0.3.3:*:*:*:*:node.js:*:*",
"cpe:2.3:a:neilcochran:squawk\\/icao-registry-data:0.8.5:*:*:*:*:node.js:*:*"
],
"extracted_events": [
{
"introduced": "0.6.2"
},
{
"last_affected": "0.6.2"
},
{
"introduced": "0.5.4"
},
{
"last_affected": "0.5.4"
},
{
"introduced": "0.4.2"
},
{
"last_affected": "0.4.2"
},
{
"introduced": "0.4.5"
},
{
"last_affected": "0.4.5"
},
{
"introduced": "0.6.4"
},
{
"last_affected": "0.6.4"
},
{
"introduced": "0.4.4"
},
{
"last_affected": "0.4.4"
},
{
"introduced": "0.6.3"
},
{
"last_affected": "0.6.3"
},
{
"introduced": "0.5.5"
},
{
"last_affected": "0.5.5"
},
{
"introduced": "0.3.5"
},
{
"last_affected": "0.3.5"
},
{
"introduced": "0.7.3"
},
{
"last_affected": "0.7.3"
},
{
"introduced": "0.8.1"
},
{
"last_affected": "0.8.1"
},
{
"introduced": "0.8.2"
},
{
"last_affected": "0.8.2"
},
{
"introduced": "0.8.4"
},
{
"last_affected": "0.8.4"
},
{
"introduced": "0.4.3"
},
{
"last_affected": "0.4.3"
},
{
"introduced": "0.5.2"
},
{
"last_affected": "0.5.2"
},
{
"introduced": "0.5.3"
},
{
"last_affected": "0.5.3"
},
{
"introduced": "0.8.7"
},
{
"last_affected": "0.8.7"
},
{
"introduced": "0.5.7"
},
{
"last_affected": "0.5.7"
},
{
"introduced": "0.6.7"
},
{
"last_affected": "0.6.7"
},
{
"introduced": "0.4.7"
},
{
"last_affected": "0.4.7"
},
{
"introduced": "0.3.7"
},
{
"last_affected": "0.3.7"
},
{
"introduced": "0.5.9"
},
{
"last_affected": "0.5.9"
},
{
"introduced": "0.3.2"
},
{
"last_affected": "0.3.2"
},
{
"introduced": "0.3.3"
},
{
"last_affected": "0.3.3"
},
{
"introduced": "0.8.5"
},
{
"last_affected": "0.8.5"
}
]
}{
"source": [
"AFFECTED_FIELD",
"CPE_STRING"
],
"cpe": [
"cpe:2.3:a:tanstack:tanstack\\/arktype-adapter:1.166.12:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/valibot-adapter:1.166.12:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/zod-adapter:1.166.12:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/arktype-adapter:1.166.15:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/react-router-ssr-query:1.166.15:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/solid-router-ssr-query:1.166.15:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/valibot-adapter:1.166.15:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/vue-router-ssr-query:1.166.15:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/zod-adapter:1.166.15:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/eslint-plugin-start:0.0.4:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/eslint-plugin-start:0.0.7:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/nitro-v2-vite-plugin:1.154.12:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/react-router:1.169.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-core:1.169.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/solid-router:1.169.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/vue-router:1.169.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/react-router:1.169.8:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-core:1.169.8:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/solid-router:1.169.8:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/vue-router:1.169.8:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/react-router-devtools:1.166.16:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-devtools:1.166.16:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/solid-router-devtools:1.166.16:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/vue-router-devtools:1.166.16:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/react-router-devtools:1.166.19:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-devtools:1.166.19:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-devtools-core:1.167.9:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/solid-router-devtools:1.166.19:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/vue-router-devtools:1.166.19:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/react-router-ssr-query:1.166.18:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/solid-router-ssr-query:1.166.18:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/vue-router-ssr-query:1.166.18:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/react-start-client:1.166.51:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/start-static-server-functions:1.166.47:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/vue-start:1.167.61:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/vue-start:1.167.64:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-cli:1.166.46:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/solid-start-client:1.166.50:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/vue-start-client:1.166.46:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/vue-start-server:1.166.50:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-cli:1.166.49:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-generator:1.166.45:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/vue-start-client:1.166.49:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-devtools-core:1.167.6:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-generator:1.166.48:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/start-static-server-functions:1.166.44:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-plugin:1.167.38:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-plugin:1.167.41:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-ssr-query-core:1.168.3:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/router-ssr-query-core:1.168.6:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/solid-start:1.167.65:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/start-client-core:1.168.5:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/start-client-core:1.168.8:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/start-server-core:1.167.33:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/start-server-core:1.167.36:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/start-storage-context:1.166.38:*:*:*:*:node.js:*:*",
"cpe:2.3:a:tanstack:tanstack\\/start-storage-context:1.166.41:*:*:*:*:node.js:*:*"
],
"extracted_events": [
{
"introduced": "1.166.12"
},
{
"last_affected": "1.166.12"
},
{
"introduced": "1.166.15"
},
{
"last_affected": "1.166.15"
},
{
"introduced": "0.0.4"
},
{
"last_affected": "0.0.4"
},
{
"introduced": "0.0.7"
},
{
"last_affected": "0.0.7"
},
{
"introduced": "1.154.12"
},
{
"last_affected": "1.154.12"
},
{
"introduced": "1.169.5"
},
{
"last_affected": "1.169.5"
},
{
"introduced": "1.169.8"
},
{
"last_affected": "1.169.8"
},
{
"introduced": "1.166.16"
},
{
"last_affected": "1.166.16"
},
{
"introduced": "1.166.19"
},
{
"last_affected": "1.166.19"
},
{
"introduced": "1.167.9"
},
{
"last_affected": "1.167.9"
},
{
"introduced": "1.166.18"
},
{
"last_affected": "1.166.18"
},
{
"introduced": "1.166.51"
},
{
"last_affected": "1.166.51"
},
{
"introduced": "1.166.47"
},
{
"last_affected": "1.166.47"
},
{
"introduced": "1.167.61"
},
{
"last_affected": "1.167.61"
},
{
"introduced": "1.167.64"
},
{
"last_affected": "1.167.64"
},
{
"introduced": "1.166.46"
},
{
"last_affected": "1.166.46"
},
{
"introduced": "1.166.50"
},
{
"last_affected": "1.166.50"
},
{
"introduced": "1.166.49"
},
{
"last_affected": "1.166.49"
},
{
"introduced": "1.166.45"
},
{
"last_affected": "1.166.45"
},
{
"introduced": "1.167.6"
},
{
"last_affected": "1.167.6"
},
{
"introduced": "1.166.48"
},
{
"last_affected": "1.166.48"
},
{
"introduced": "1.166.44"
},
{
"last_affected": "1.166.44"
},
{
"introduced": "1.167.38"
},
{
"last_affected": "1.167.38"
},
{
"introduced": "1.167.41"
},
{
"last_affected": "1.167.41"
},
{
"introduced": "1.168.3"
},
{
"last_affected": "1.168.3"
},
{
"introduced": "1.168.6"
},
{
"last_affected": "1.168.6"
},
{
"introduced": "1.167.65"
},
{
"last_affected": "1.167.65"
},
{
"introduced": "1.168.5"
},
{
"last_affected": "1.168.5"
},
{
"introduced": "1.168.8"
},
{
"last_affected": "1.168.8"
},
{
"introduced": "1.167.33"
},
{
"last_affected": "1.167.33"
},
{
"introduced": "1.167.36"
},
{
"last_affected": "1.167.36"
},
{
"introduced": "1.166.38"
},
{
"last_affected": "1.166.38"
},
{
"introduced": "1.166.41"
},
{
"last_affected": "1.166.41"
}
]
}