The vulnerability arises from an attacker publishing malicious versions of 42 @tanstack/* packages with legitimate GitHub Actions OIDC credentials. The attacker leveraged misconfigurations in pull_request_target workflows, cache poisoning across fork‑to‑base trust boundaries, and extraction of OIDC tokens from runner processes to embed credential‑stealing malware. The result was the exfiltration of cloud credentials, GitHub tokens, and SSH keys to the attacker. This is a high‑impact breach of confidentiality, categorized as CWE‑506.

Affected products include every @tanstack package listed in the vulnerability, such as arktype-adapter, eslint‑plugin‑router, react‑router, solid‑router, vue‑router, and others. In total, 84 malicious versions were released, exactly two for each of the 42 packages. No specific version numbers are provided in the advisory, but all releases published between 2026‑05‑11 19:20 and 19:26 UTC should be treated as compromised.

The CVSS score of 9.6 reflects a severe threat with high impact on confidentiality and potential widespread compromise. EPSS is not available, so the exploitation probability is unknown, but the risk is high because the attacker used a legitimate publisher identity and had successful direct access to the npm registry. The vulnerability is not listed in CISA KEV at this time. Exploitation requires three coordinated misconfigurations: an unprotected pull_request_target, cache poisoning across fork boundaries, and memory read of OIDC tokens, after which the malicious packages can be distributed to any consumer who installs them.