Cyber

What changed

On May 11, 2026, a significant security incident occurred involving the TanStack npm registry. During a brief window, 84 malicious versions of packages across 42 @tanstack/* packages were published, leveraging a series of known vulnerabilities.

The attack utilized a combination of a pull_request_target misconfiguration, GitHub Actions cache poisoning, and runtime memory extraction to publish malware disguised under a trusted identity.

Who is affected

The incident primarily impacts users and developers utilizing TanStack packages within their applications. The following groups are particularly vulnerable:

Organizations that rely on TanStack/router and other related packages for their projects may have inadvertently integrated compromised versions.

• Developers using @tanstack/* packages in their applications.
• Organizations leveraging TanStack/router for routing solutions.
• Users who have installed affected packages from the npm registry.

What to do

It is crucial for affected users and organizations to take immediate action to mitigate potential risks associated with this incident. Users should audit their dependencies and remove any compromised packages.

Additionally, monitoring for unusual activity and implementing security best practices around package management can help prevent future incidents.

• Review and update all dependencies to ensure no malicious versions are in use.
• Implement stricter controls around package publishing and usage.
• Educate development teams on secure coding practices and the importance of dependency management.

What changed

A vulnerability has been identified in the Apache Camel Camel-Coap component, specifically related to the improper control of dynamically-determined object attributes. This flaw enables Camel message header injection, which can lead to remote code execution when CoAP requests are forwarded to sensitive producers.

The issue arises from the mapping of incoming CoAP request URI query parameters directly into Camel Exchange message headers without adequate filtering. This oversight can be exploited, posing significant risks to applications using this component.

Who is affected

Organizations utilizing the Apache Camel framework, particularly those employing the Camel-Coap component, are at risk. The following groups are notably affected:

Developers and system integrators using Apache Camel for IoT applications, where CoAP is commonly implemented.

• Users of Apache Camel versions that include the Camel-Coap component.
• Organizations relying on CoAP for communication in their IoT solutions.
• Developers implementing header-sensitive producers like camel-exec.

What to do

It is crucial for affected organizations to assess their use of the Apache Camel Camel-Coap component and implement necessary mitigations. Immediate actions include reviewing application configurations and applying updates as they become available.

Monitoring for unusual activity related to CoAP requests and message headers is also recommended to detect potential exploitation attempts.

• Update to the latest version of Apache Camel as soon as patches are released.
• Implement strict input validation and filtering for incoming CoAP requests.
• Review and enhance security measures around header-sensitive producers.