Research · May 11, 2026 · ZeroDay Catalog
Malicious Packages Published in TanStack Registry Exploit Known Vulnerabilities
A series of malicious packages have been published to the TanStack npm registry, exploiting known vulnerabilities to deliver credential-stealing malware.
What changed
On May 11, 2026, a significant security incident occurred involving the TanStack npm registry. During a brief window, 84 malicious versions of packages across 42 @tanstack/* packages were published, leveraging a series of known vulnerabilities.
The attack utilized a combination of a pull_request_target misconfiguration, GitHub Actions cache poisoning, and runtime memory extraction to publish malware disguised under a trusted identity.
Who is affected
The incident primarily impacts users and developers utilizing TanStack packages within their applications. The following groups are particularly vulnerable:
Organizations that rely on TanStack/router and other related packages for their projects may have inadvertently integrated compromised versions.
- Developers using @tanstack/* packages in their applications.
- Organizations leveraging TanStack/router for routing solutions.
- Users who have installed affected packages from the npm registry.
What to do
It is crucial for affected users and organizations to take immediate action to mitigate potential risks associated with this incident. Users should audit their dependencies and remove any compromised packages.
Additionally, monitoring for unusual activity and implementing security best practices around package management can help prevent future incidents.
- Review and update all dependencies to ensure no malicious versions are in use.
- Implement stricter controls around package publishing and usage.
- Educate development teams on secure coding practices and the importance of dependency management.