Vulnerability MAL-2026-3490
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 months ago
May 12, 2026 at 12:02 AM UTC
Malicious code in @tanstack/start-server-core (npm)
1.167.33 and 1.167.36
1.167.33 and 1.167.36
Summary
Malicious code in @tanstack/start-server-core (npm)
Details
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
7 hours ago
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
1.143.12 - 1.169.38 GHSA-qx66-fv34-fjm8
1.143.12 - 1.169.38 GHSA-qx66-fv34-fjm8
Medium Risk
5 months ago
TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function
1.20.3-alpha.1 - 1.167.29 GHSA-9m65-766c-r333
1.20.3-alpha.1 - 1.167.29 GHSA-9m65-766c-r333
Critical
5 months ago
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
1.167.33 and 1.167.36 GHSA-g7cv-rxg3-hmpx
1.167.33 and 1.167.36 GHSA-g7cv-rxg3-hmpx
Impacted packages
Timeline
Published
5 months ago
May 12, 2026 at 12:02 AM UTC
Last Modified
5 months ago
May 12, 2026 at 07:10 AM UTC