On May 11, 2026, an attacker published 84 malicious package versions across 42 @tanstack npm packages, including arktype-adapter, by abusing GitHub Actions OIDC trusted-publisher bindings. The attack chain involved a pull_request_target misconfiguration allowing code execution, cache poisoning crossing fork-to-base trust boundaries, and runtime memory extraction of OIDC tokens from the Actions runner. This enabled the attacker to publish credential-stealing malware under legitimate publisher credentials without modifying the publish workflow itself. Each affected package received exactly two malicious versions published minutes apart. The vulnerability is tracked as CVE-2026-45321 with a CVSS 3.1 score of 9.6 (critical). No patch or official remediation has been disclosed.

The vulnerability allows an attacker to publish malicious versions of trusted npm packages under legitimate publisher credentials, potentially distributing credential-stealing malware to users who install these packages. This compromises confidentiality, integrity, and availability of affected systems. The attack leverages weaknesses in CI/CD pipeline configurations and token handling, undermining trust in the software supply chain. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using the affected versions (1.166.12 and 1.166.15) of the @tanstack arktype-adapter and related packages. Review and harden GitHub Actions workflows to prevent pull_request_target misconfigurations and cache poisoning. Monitor for updates from the @tanstack project and npm registry regarding patched versions or further mitigation steps.