CVE-2026-45321: TanStack Unspecified Vulnerability

TanStack contains an unspecified vulnerability that allowed malicious versions of the package to be published to the npm registry under a trusted identity. Attackers used this to distribute credential-stealing malware, and the vulnerability has known ransomware associations.

How it works

The weakness permitted unauthorized or altered package versions to reach the public npm registry while appearing to originate from the legitimate TanStack maintainer. An attacker could then deliver malware that targets credentials once the package is installed in a downstream project. No specific exploit mechanics or code paths are detailed in the available information.

Am I affected? How to find it in your systems

TanStack packages are commonly included in Node.js and browser-based web applications. Begin by auditing all projects that declare TanStack dependencies in package.json or equivalent manifest files. Use npm list or your package manager’s equivalent to surface installed versions. Confirm whether any listed versions match the affected releases by checking the vendor advisory directly. Review build and CI logs for unexpected package resolutions or publish events. Monitor runtime environments for anomalous outbound connections or credential-access attempts that may indicate the malware component has executed.

How to remediate

Apply the vendor-supplied update referenced in the official advisory as the primary step. After patching, regenerate package-lock.json or yarn.lock files from a clean state and verify package signatures or integrity hashes where the registry supports them. Restrict npm publish permissions for internal scoped packages and enforce two-factor authentication on all maintainer accounts. Rebuild and redeploy affected applications only after confirming the updated packages are in use.

If you can't patch immediately

Follow the CISA directive to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Segment development and build environments from production networks. Implement network-level controls that block unexpected outbound traffic from build agents. Increase monitoring for npm registry anomalies and credential-use patterns. For cloud-hosted services, apply the controls outlined in BOD 22-01. Consider temporarily replacing TanStack components with alternative libraries until a verified update can be deployed.

If your data may have been exposed

Because this vulnerability has known ransomware associations, treat any environment that installed affected packages as potentially compromised. Review authentication logs and credential stores for signs of exfiltration. Run a free exposure scan of organizational email addresses against known breach data to identify accounts that may already appear in public dumps.