9.6Kritisch
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
@tanstack arktype-adapter; @tanstack eslint-plugin-router; @tanstack eslint-plugin-start; @tanstack history
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/r…
3.3%EPSS