Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
@tanstack arktype-adapter — Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N R C H H H 9.6 .0234 82.3 YES
AFFECTED
Product Versions Fixed
arktype-adapter 1.166.12 – —
eslint-plugin-router 1.161.9 – —
eslint-plugin-start 0.0.4 – —
history 1.161.9 – —
nitro-v2-vite-plugin 1.154.12 – —
react-router 1.169.5 – —
react-router-devtools 1.166.16 – —
react-router-ssr-query 1.166.15 – —
react-start 1.167.68 – —
react-start-client 1.166.51 – —
+ 32 more
TIMELINE
May 11 Reserved by GitHub_M
May 27 Added to CISA KEV, remediation due 2026-06-10
May 27 Published (CNA: GitHub_M)
Jun 11 DUE DATE PASSED — CVE-2026-45321 (@tanstack arktype-adapter). CISA remediation deadline was June 10, 2026; still in catalog.
Description
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| May 11, 2026 | Reserved | Reserved by GitHub_M |
| May 27, 2026 | KEV ADDED | Added to CISA KEV, remediation due 2026-06-10 |
| May 27, 2026 | Published | Published (CNA: GitHub_M) |
| June 11, 2026 | DUE DATE PASSED | DUE DATE PASSED — CVE-2026-45321 (@tanstack arktype-adapter). CISA remediation deadline was June 10, 2026; still in catalog. |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-45321 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.