Update TanStack router packages to patched versions after npm supply-chain compromise #482

Description

The TanStack team disclosed a supply-chain attack on 2026-05-11 where 84 malicious versions across 42 @tanstack/* packages were published to npm (CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx). Malicious tarballs execute router_init.js (~2.3 MB) at install time, which harvests cloud credentials (AWS IMDS / Secrets Manager, GCP metadata, Kubernetes service-account tokens, Vault tokens), ~/.npmrc, GitHub tokens, and SSH keys, then exfiltrates them over the Session messenger network. It also installs a persistence agent (~/.local/bin/gh-token-monitor.sh / systemd user service / macOS LaunchAgent) that runs rm -rf ~ if the stolen GitHub token is revoked.

dAppBooster ships these affected packages in package.json:

Transitive (pulled by the above; check after bumps):

@tanstack/react-query, @tanstack/react-query-devtools, and @tanstack/react-virtual are confirmed unaffected by the postmortem.

Today's lockfile pins versions BELOW the malicious window so the installed tree is clean, but the ^ ranges in package.json would resolve into the malicious window on any fresh resolution (deleted lockfile, pnpm update, Renovate/Dependabot). The malicious versions are deprecated on npm, but tarballs may still be installable in some mirrors and caches.

Steps to reproduce

1. Delete pnpm-lock.yaml and node_modules.
2. Run pnpm install.
3. Inspect resolved versions of @tanstack/router-plugin, @tanstack/react-router, @tanstack/router-cli, @tanstack/react-router-devtools and their transitive deps.
4. Before the npm registry deprecation propagated, the caret ranges would have resolved to malicious versions in the affected ranges above.

Expected vs actual behavior

Expected: All @tanstack/* resolutions land on patched versions (>= 1.169.9 for the react-router family, etc.) and the project documents the audit so future fresh installs cannot regress.

Actual: package.json carets cover the malicious window. The lockfile is clean today only because it predates the attack.

Reproduction link

TanStack/router#7383

Environment

Node: 24+ (.nvmrc)
pnpm: 10.33.0
@tanstack/react-router: 1.168.10 (locked)
@tanstack/react-router-devtools: 1.166.11 (locked)
@tanstack/router-cli: 1.166.25 (locked)
@tanstack/router-plugin: 1.167.12 (locked)

Additional context

Acceptance criteria

• Bump direct deps in package.json to the patched releases (or higher):
  • @tanstack/react-router -> ^1.169.9
  • @tanstack/react-router-devtools -> ^1.166.20
  • @tanstack/router-cli -> ^1.166.50
  • @tanstack/router-plugin -> ^1.167.42
• Regenerate pnpm-lock.yaml and confirm no transitive @tanstack/* version falls in a vulnerable range.
• Run pnpm wagmi-generate, pnpm routes:generate, pnpm lint, pnpm test, and pnpm build to confirm the bump is non-breaking.

Interim mitigation (until patched versions are on npm)

• Pin @tanstack/react-router, @tanstack/react-router-devtools, @tanstack/router-cli, @tanstack/router-plugin to exact current-latest non-malicious versions to prevent ^-drift.
• Once the GHSA-listed patched versions land on npm, replace the exact pins with caret ranges floored above the malicious window, then close this issue.

References

• Tracking issue: Several npm latest releases were compromised TanStack/router#7383
• Postmortem: https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
• GHSA: GHSA-g7cv-rxg3-hmpx
• CVE: CVE-2026-45321