Actively exploited vulnerabilities affecting TanStack products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2026-45321https://wildfortech.com/security#CVE-2026-45321This vulnerability allowed attackers to publish malicious versions of TanStack packages to the npm registry under the project's trusted identity. Because developers and build pipelines inherently trust packages from known publishers, this created a supply-chain attack vector where credential-stealing malware could be silently introduced into downstream projects. The fact that ransomware actors have leveraged this makes it especially severe — any environment that pulled affected package versions may have had credentials compromised.Wed, 27 May 2026 00:00:00 GMTTanStackTanStack