Records1All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Neilcochran records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsPriority CRITICAL 100KEV
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.03278 · Published 2026-05-12 · Fixed in 1.166.16, 1.161.13 +26 CWE-506
