Malicious packages were published to npm registry exploiting TanStack identity to steal credentials
- CISA added CVE-2026-45321 affecting TanStack Router to the Known Exploited Vulnerabilities catalog
- Vulnerability allowed attackers to publish credential-stealing malware using TanStack’s trusted identity on npm
- Federal agencies must apply mitigations by 10 June 2026 or discontinue use
The Cybersecurity and Infrastructure Security Agency has added CVE-2026-45321 to its Known Exploited Vulnerabilities catalog, affecting the popular TanStack Router JavaScript library.
The vulnerability allowed malicious actors to publish credential-stealing malware packages to the npm registry under TanStack’s trusted identity. This supply chain attack exploited the trusted reputation of TanStack to distribute malicious code through what appeared to be legitimate package updates.
According to CISA’s KEV entry, the vulnerability affects TanStack’s routing library, which is widely used in JavaScript applications for client-side navigation and routing functionality.
The agency has issued specific remediation requirements for federal agencies under Binding Operational Directive 22-01. Organisations must either apply mitigations according to vendor instructions, follow applicable cloud services guidance, or discontinue use of the affected product if mitigations are unavailable.
Federal agencies have until 10 June 2026 to complete remediation efforts. CISA notes this vulnerability could affect various products that incorporate the TanStack library as an open-source component or third-party dependency.
The security advisory from TanStack’s GitHub repository and additional technical details are available through the National Vulnerability Database.
Why It Matters
This supply chain attack highlights the risks of trusted package repositories being compromised. For CISOs, this represents a significant third-party risk that can bypass traditional security controls, as malicious code appears to come from legitimate, trusted sources.
The inclusion in CISA’s KEV catalog indicates active exploitation in the wild. Organisations using JavaScript applications with TanStack Router dependencies face immediate credential theft risks and potential broader network compromise through stolen authentication data.
What To Do Now
- Audit all applications for TanStack Router dependencies using software composition analysis tools
- Review TanStack’s security advisory for specific mitigation guidance
- Monitor npm package integrity and implement package verification processes for critical dependencies
- Check CVE-2026-45321 details for additional technical information
