{"action":"Upgrade @tanstack/eslint-plugin-router to 1.161.13 or later.","affected":[{"fixed":"1.161.13","introduced":"1.161.9"},{"fixed":"1.161.13","introduced":"1.161.12"}],"component":"@tanstack/eslint-plugin-router","cve_ids":["CVE-2026-45321"],"ecosystem":"npm","epss":0.01054,"exploited":true,"fixed_versions":["1.161.13"],"ghsa_id":"GHSA-g7cv-rxg3-hmpx","id":"tcs_01M5KFQJFJCX7GXN0YRK1TZHFM","modified_at":"2026-09-10T03:51:05.608689266Z","published_at":"2026-05-12T00:12:49Z","references":["https://osv.dev/vulnerability/GHSA-g7cv-rxg3-hmpx","https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","https://nvd.nist.gov/vuln/detail/CVE-2026-45321","https://github.com/TanStack/router/issues/7383","https://github.com/TanStack/router","https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack","https://tanstack.com/blog/npm-supply-chain-compromise-postmortem","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321","https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-g7cv-rxg3-hmpx#npm/@tanstack/eslint-plugin-router","url":"https://osv.dev/vulnerability/GHSA-g7cv-rxg3-hmpx"},{"source":"kev","source_id":"CVE-2026-45321","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys"}