CVE-2026-45321 in arktype-adapter
Summary
by MITRE • 05/12/2026
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/04/2026
The compromise of the tanstack/* npm packages represents a sophisticated supply chain attack that leveraged multiple vulnerability classes to establish persistent access and execute credential theft operations. This attack targeted the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, which allowed attackers to publish malicious versions of packages under a trusted identity. The attack occurred within a narrow time window of approximately six minutes, with 84 malicious versions across 42 packages published simultaneously, demonstrating the attackers' ability to coordinate and execute large-scale malicious operations. The compromised packages were specifically chosen to exploit the trust relationship between the legitimate publisher and the npm registry, enabling the attackers to bypass normal security controls that would typically prevent unauthorized package modifications.
The attack chain utilized three distinct vulnerability classes that together created a complete exploitation pathway. The first vulnerability was a pull_request_target misconfiguration that allowed attackers to execute malicious code in the context of the legitimate repository's workflow. This misconfiguration enabled the attackers to gain access to the repository's environment and establish a foothold for further exploitation. The second vulnerability involved GitHub Actions cache poisoning across the fork↔base trust boundary, which permitted attackers to manipulate the build environment and inject malicious code into the package publishing process. The third vulnerability was runtime memory extraction of the OIDC token from the Actions runner process, which allowed attackers to steal the legitimate authentication credentials that were used to publish the malicious packages. This combination of vulnerabilities created a complete attack chain that enabled attackers to publish malicious code under a trusted identity while maintaining access to the legitimate credentials.
The operational impact of this attack extends beyond simple package compromise, as the attackers were able to establish persistent access and execute credential theft operations within the legitimate repository environment. Each affected package received exactly two malicious versions published a few minutes apart, suggesting that the attackers were testing or validating their access before deploying the full payload. The attack demonstrates how attackers can exploit legitimate trust relationships to bypass traditional security controls, as the malicious packages were published using the legitimate OIDC token that was supposed to provide authentication. The attackers' ability to chain these vulnerabilities together shows the interconnected nature of modern software supply chain attacks, where a single misconfiguration in one component can lead to compromise of an entire ecosystem. This type of attack aligns with ATT&CK technique T1583.001 for acquisition of credentials and T1078.004 for valid accounts, as it leveraged legitimate authentication mechanisms to maintain access.
The mitigation strategies for this type of attack must address multiple layers of the software supply chain security model. Organizations should implement strict access controls and review procedures for repository maintainers, particularly focusing on pull_request_target workflow configurations that can be exploited for unauthorized code execution. The use of GitHub Actions cache poisoning prevention mechanisms should be strengthened, including implementing proper isolation between fork and base repositories and monitoring for unauthorized cache modifications. Memory extraction attacks require runtime monitoring and memory protection mechanisms to prevent credential theft from automated processes. Additionally, organizations should implement package integrity verification systems that can detect unauthorized modifications to legitimate packages, including monitoring for packages that are published with malicious versions under trusted identities. The attack also highlights the importance of implementing multi-factor authentication and just-in-time access controls for sensitive repository operations, as well as regular security audits of automated workflows to identify potential misconfigurations that could be exploited by attackers. This incident demonstrates that supply chain attacks are increasingly sophisticated and require comprehensive security approaches that address both configuration vulnerabilities and runtime protection mechanisms. The attack aligns with CWE categories related to insecure configuration and credential exposure, emphasizing the need for robust security practices throughout the software development lifecycle.