Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

arktype-adapter

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

CVE-2026-45321 describes a supply chain attack on the @tanstack npm packages, including arktype-adapter, where an attacker leveraged a combination of a pull_request_target misconfiguration, GitHub Actions cache poisoning, and runtime memory extraction of OIDC tokens to publish malicious versions under a trusted identity. This attack resulted in 84 malicious versions being published across 42 packages, each receiving two malicious versions. The attack exploited the trusted GitHub Actions OIDC publisher binding without modifying the publish workflow itself. The affected versions of @tanstack/arktype-adapter are exactly 1.166.12 and 1.166.15. The CVSS score is 9.6 (critical), indicating high impact on confidentiality, integrity, and availability.

Detailed information about CVE-2026-45321: CWE-506: Embedded Malicious Code in @tanstack arktype-adapter affecting @tanstack arktype-adapter. Get real-time upda

CVE-2026-45321: CWE-506: Embedded Malicious Code in @tanstack arktype-adapter - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-45321: CWE-506: Embedded Malicious Code in @tanstack arktype-adapter

Threats Tagged 'cve-2026-45321'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2026-45321'

Lead Pen Test Professional