Hostile 92% javascript Download

@tanstack/vue-router-ssr-query 1.166.18

Obfuscated credential-stealing malware

Lone scoped optional dep on VCS commitDetached self re-exec behavior
SHA-2567a13a207d74cdb0e83c1ac0a6d9895c68225f63b5708b0589603ecd19a49970d
URLhttps://registry.npmjs.org/@tanstack/vue-router-ssr-query/-/vue-router-ssr-query-1.166.18.tgz
MaleculeK(Li)O₄(SAs₄Ca₂Dy)H₆(Po₄Cm₈CrDb₁₀F₄Os₆)Md₃(InPa₇)

Also flagged by https://falhumaid.github.io/DFIR_Radar_RSS/rss.xml (Analyse de l’attaque de la supply chain TanStack), https://feeds.feedburner.com/TheHackersNews (CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories), osv (MAL-2026-3497: Malicious code in @tanstack/vue-router-ssr-query (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.