CVE-2026-45321 TanStack npm包供应链攻击漏洞 (GitHub Actions OIDC令牌窃取)

# Conceptual PoC: Detection script for suspicious TanStack package versions # Check if any @tanstack package was installed during the attack window (2026-05-11 19:20 - 19:26 UTC) import json import sys from datetime import datetime, timezone def check_package_lock(file_path): attack_start = datetime(2026, 5, 11, 19, 20, tzinfo=timezone.utc) attack_end = datetime(2026, 5, 11, 19, 26, tzinfo=timezone.utc) try: with open(file_path, 'r') as f: data = json.load(f) print(f"[*] Analyzing {file_path}...") # Simplified logic for package-lock.json structure if 'packages' in data: for path, details in data['packages'].items(): if '@tanstack' in path: # In a real scenario, check the 'integrity' hash or version publication time # Here we just flag the presence of the package for manual review print(f"[!] Suspicious package found: {path}") print(f" Version: {details.get('version', 'unknown')}") print(f" Action: Verify this version against official advisories.") except FileNotFoundError: print("Error: File not found.") except Exception as e: print(f"Error parsing JSON: {e}") if __name__ == "__main__": if len(sys.argv) > 1: check_package_lock(sys.argv[1]) else: print("Usage: python3 check_tanstack.py package-lock.json")