Overview
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities catalog:
CVE-2026-8398 (Daemon Tools Lite Embedded Malicious Code)
CVE-2026-45321 (TanStack Unspecified Vulnerability)
CVE-2026-48027 (Nx Console Embedded Malicious Code).
The additions mark a significant escalation in software supply chain threats aimed at both end-user applications and the developer tooling ecosystem. Federal Civilian Executive Branch agencies have until June 17, 2026, to apply mitigations or cease use of affected products under BOD 22-01.
CVE-2026-8398 — DAEMON Tools Lite | Embedded Malicious Code
CVE-2026-8398 is a remote code execution flaw in DAEMON Tools Lite version 11.2.0 and earlier. Attackers weaponized the trusted installer mechanism — users who believed they were downloading from a legitimate source received a trojanized package. Mitigation is straightforward: update to DAEMON Tools Lite 11.2.1 or uninstall the software. CISA also recommends blocking .iso and .mdx file downloads from unteusted sources as a temporary workaround.
CVE-2026-45321 — TanStack npm Packages | CI/CD Supply Chain Attack
CVE-2026-45321 describes a chained exploitation of three weaknesses in TanStack’s GitHub Actions CI/CD configuration. The attacker created a fork of the TanStack/router repository under a renamed account to avoid detection, then opened a pull request that triggered a pull_request_target workflow. This workflow executed code from the attacker’s fork in the base repository’s trusted context, allowing the attacker to poison the GitHub Actions cache with malicious binaries.
When legitimate maintainer pull requests were later merged, the release workflow restored the poisoned cache. Attacker-controlled code then extracted OpenID Connect (OIDC) tokens from the runner’s process memory and exchanged them with npm’s federation endpoint for full publish credentials.
The result was 84 malicious package versions published across 42 TanStack packages in under six minutes, all carrying valid SLSA Build Level 3 provenance attestations from Sigstore.
Remediation requires identifying all software components that bundle affected TanStack versions via thorough software composition analysis (SCA). CISA’s guidance points to tools like OWASP Dependency-Check or commercial SCA solutions to generate an accurate inventory.
CVE-2026-48027 — Nx Console | Embedded Malicious Code
Nx Console, a widely used VS Code/JetBrains extension for monorepo management, was compromised via malicious code embedded in the extension package — targeting developer workstations directly through the IDE toolchain. Remediation requires updating Nx Console to the latest version and scanning developer environments for indicators of compromise.
Campaign Attribution
Multiple independent security firms attribute all three chains to TeamPCP, a financially motivated cybercriminal group that emerged in late 2025. All three chains converge on the same post-exploitation behavior: credentials exfiltrated through three redundant channels. This is the same group behind the earlier PyTorch Lightning (Mini Shai-Hulud) attack TheCyberThrone covered previously.
