CVE‑2026‑45321: TanStack Library Supply‑Chain Vulnerability Enables Credential‑Stealing npm Packages
What It Is – An unspecified flaw in the TanStack JavaScript library allowed an attacker to publish malicious versions of the package to the public npm registry under the legitimate TanStack identity.
Exploitability – The vulnerability is actively exploited in the wild; malicious packages have been observed stealing developer credentials. CISA has listed it in the KEV program, indicating a high likelihood of exploitation.
Affected Products – TanStack UI component libraries distributed via npm (all versions prior to the vendor’s forthcoming patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous third‑party component monitoring and immutable SBOMs to prove due‑diligence.
- Highlights gaps in supply‑chain governance that auditors will scrutinize when evaluating a vendor’s control environment.
- Provides a concrete example of why enterprises must retain verifiable evidence of package provenance for audit readiness.
Recommended Actions
- Generate an up‑to‑date Software Bill of Materials (SBOM) and identify any TanStack dependencies.
- Block unverified npm packages at the repository gateway and enforce signed package verification.
- Apply the vendor‑released patch as soon as it is available; in the interim, replace TanStack with a vetted alternative.
- Integrate continuous monitoring of npm registry activity into your third‑party risk program.
Source: CISA KEV – CVE‑2026‑45321