package

npm/@tanstack/start-server-core

pkg:npm/%40tanstack/start-server-core

MEDIUMnpm

TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function

Modified: 5/14/2026

CRITICAL9.6npm

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

Modified: 9/10/2026

—npm

Malicious code in @tanstack/start-server-core (npm)

Modified: 5/12/2026