The vulnerability arises from an attacker publishing malicious versions of 42 @tanstack/* packages with legitimate GitHub Actions OIDC credentials. The attacker leveraged misconfigurations in pull_request_target workflows, cache poisoning across fork‑to‑base trust boundaries, and extraction of OIDC tokens from runner processes to embed credential‑stealing malware. The result was the exfiltration of cloud credentials, GitHub tokens, and SSH keys to the attacker. This is a high‑impact breach of confidentiality, categorized as CWE‑506.

Affected products include every @tanstack package listed in the vulnerability, such as arktype‑adapter, eslint‑plugin‑router, react‑router, solid‑router, vue‑router, and others. In total, 84 malicious versions were released, exactly two for each of the 42 packages. No specific version numbers are provided in the advisory, but all releases published between 2026‑05‑11 19:20 and 19:26 UTC should be treated as compromised.

The CVSS score of 9.6 reflects a severe threat with high impact on confidentiality and potential widespread compromise. The EPSS score of 17% indicates the probability of exploitation is moderate, reflecting a higher likelihood that npm consumers could be affected when malicious versions are published. The vulnerability is listed in the CISA KEV catalog and requires coordinated misconfigurations—unprotected pull_request_target, cache poisoning across fork‑to‑base trust boundaries, and memory extraction of OIDC tokens—to be deployed. Once a malicious version is published, any consumer installing the affected @tanstack/* package immediately introduces credential‑stealing malware into their environment.