Embedded Malicious Code Affecting tanstack package, versions =2.0.4=2.0.5=2.0.6=2.0.7
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-TANSTACK-16322745
- published30 Apr 2026
- disclosed29 Apr 2026
- creditUnknown
Introduced: 29 Apr 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the tanstack package.
Overview
tanstack is a TanStack Player — A developer-first, universal Video Player SDK built on Video.js with headless hooks, plugin architecture, and React-first DX
Affected versions of this package are vulnerable to Embedded Malicious Code that exfiltrates environment variables from developers' machines during installation. While this package might be attempting to impersonate a valid organization (@tanstack/*), there is no connection between that organization and this unscoped package.
Note: While the package existed for over a month and most of the early code was benign and operating simply as a "TanStack Player" video SDK with no network calls, in affected versions, the threat actor pivoted to malicious activity.