Malicious versions of TanStack npm packages (CVE-2026-45321) — credential-stealing malware shipped under a trusted name

CVE-2026-45321 covers a case where malicious versions were published to the npm registry for TanStack (the TanStack Query/Router/Table libraries widely used in the React ecosystem). It was added to CISA's KEV catalog on May 27, 2026, with ransomware use also confirmed.

The key point is that the malware was distributed by abusing a "trusted identity." To users it looks like a new version of a legitimate package they already use, so an `npm install` or version bump can pull in credential-stealing malware unnoticed. What gets stolen are developer tokens and keys, which then become the starting point for further compromise under a legitimate guise.

It entered KEV around the same time as Nx Console (CVE-2026-48027); both are supply-chain attacks targeting the development ecosystem (npm / IDE extensions) and are emblematic of recent attack trends.

Key response: if you use TanStack-related packages, check the affected packages and versions in the vendor's GitHub Security Advisory (GHSA-g7cv-rxg3-hmpx) and update to a safe version. Inspect lockfiles and resolved dependencies (both direct and transitive), and on machines or CI that installed/updated during the suspicious window, revoke and reissue the tokens and keys used. The federal civilian remediation deadline was June 10, 2026.