Update TanStack router packages to patched versions after npm supply-chain compromise

[gabitoesmiapodo]

Warning

Transitory mitigation in flight. As of 2026-05-12, the patched versions named in the GHSA advisory (@tanstack/react-router@1.169.9, @tanstack/react-router-devtools@1.166.20, @tanstack/router-cli@1.166.50, @tanstack/router-plugin@1.167.42) have not been published to npm. npm view returns 404 for those tags; the registry currently tops out below the malicious window (e.g. @tanstack/react-router latest is 1.169.2). The malicious tarballs were pulled server-side, but no patched build is yet live.

The in-flight PR pins direct deps to the current latest non-malicious versions (1.169.2 / 1.166.13 / 1.166.43 / 1.167.35) using exact specifiers to neutralise the ^-drift exposure. This issue must remain open until the GHSA-listed patched versions appear on npm; a follow-up PR should then move the pins to those versions and (optionally) restore ^ ranges.

Description

The TanStack team disclosed a supply-chain attack on 2026-05-11 where 84 malicious versions across 42 @tanstack/* packages were published to npm (CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx). Malicious tarballs execute router_init.js (~2.3 MB) at install time, which harvests cloud credentials (AWS IMDS / Secrets Manager, GCP metadata, Kubernetes service-account tokens, Vault tokens), ~/.npmrc, GitHub tokens, and SSH keys, then exfiltrates them over the Session messenger network. It also installs a persistence agent (~/.local/bin/gh-token-monitor.sh / systemd user service / macOS LaunchAgent) that runs rm -rf ~ if the stolen GitHub token is revoked.

dAppBooster ships these affected packages in package.json:

Package	Current spec	Locked version	Vulnerable	Patched
@tanstack/react-router	^1.168.10	1.168.10	1.169.5, 1.169.8	1.169.9
@tanstack/react-router-devtools (dev)	^1.166.11	1.166.11	1.166.16, 1.166.19	1.166.20
@tanstack/router-cli (dev)	^1.166.25	1.166.25	1.166.46, 1.166.49	1.166.50
@tanstack/router-plugin (dev)	^1.167.12	1.167.12	1.167.38, 1.167.41	1.167.42

Transitive (pulled by the above; check after bumps):

Package	Locked version	Vulnerable	Patched
@tanstack/router-core	1.168.9	1.169.5, 1.169.8	1.169.9
@tanstack/history	1.161.6	1.161.9, 1.161.12	1.161.13
@tanstack/router-generator	1.166.24	1.166.45, 1.166.48	1.166.49
@tanstack/router-utils	1.161.6	1.161.11, 1.161.14	1.161.15
@tanstack/virtual-file-routes	1.161.7	1.161.10, 1.161.13	1.161.14
@tanstack/router-devtools-core	1.167.1	1.167.6, 1.167.9	1.167.10

@tanstack/react-query, @tanstack/react-query-devtools, and @tanstack/react-virtual are confirmed unaffected by the postmortem.

Today's lockfile pins versions BELOW the malicious window so the installed tree is clean, but the ^ ranges in package.json would resolve into the malicious window on any fresh resolution (deleted lockfile, pnpm update, Renovate/Dependabot). The malicious versions are deprecated on npm, but tarballs may still be installable in some mirrors and caches.

Steps to reproduce

1. Delete pnpm-lock.yaml and node_modules.
2. Run pnpm install.
3. Inspect resolved versions of @tanstack/router-plugin, @tanstack/react-router, @tanstack/router-cli, @tanstack/react-router-devtools and their transitive deps.
4. Before the npm registry deprecation propagated, the caret ranges would have resolved to malicious versions in the affected ranges above.

Expected vs actual behavior

Expected: All @tanstack/* resolutions land on patched versions (>= 1.169.9 for the react-router family, etc.) and the project documents the audit so future fresh installs cannot regress.

Actual: package.json carets cover the malicious window. The lockfile is clean today only because it predates the attack.

Reproduction link

TanStack/router#7383

Environment

Node: 24+ (.nvmrc)
pnpm: 10.33.0
@tanstack/react-router: 1.168.10 (locked)
@tanstack/react-router-devtools: 1.166.11 (locked)
@tanstack/router-cli: 1.166.25 (locked)
@tanstack/router-plugin: 1.167.12 (locked)

Additional context

Acceptance criteria

• Bump direct deps in package.json to the patched releases (or higher):
  • @tanstack/react-router -> ^1.169.9
  • @tanstack/react-router-devtools -> ^1.166.20
  • @tanstack/router-cli -> ^1.166.50
  • @tanstack/router-plugin -> ^1.167.42
• Regenerate pnpm-lock.yaml and confirm no transitive @tanstack/* version falls in a vulnerable range.
• Run pnpm wagmi-generate, pnpm routes:generate, pnpm lint, pnpm test, and pnpm build to confirm the bump is non-breaking.

Interim mitigation (until patched versions are on npm)

• Pin @tanstack/react-router, @tanstack/react-router-devtools, @tanstack/router-cli, @tanstack/router-plugin to exact current-latest non-malicious versions to prevent ^-drift.
• Once the GHSA-listed patched versions land on npm, replace the exact pins with caret ranges floored above the malicious window, then close this issue.

References

• Tracking issue: Several npm latest releases were compromised TanStack/router#7383
• Postmortem: https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
• GHSA: GHSA-g7cv-rxg3-hmpx
• CVE: CVE-2026-45321