Post

⚠️ If you use any TanStack package in any of your projects and there's any chance any of them was updated today, stop what you're doing and read this. ... Actually there are 121 non-tanstack packages affected as well, so check the list anyway.

Socket@socket.dev

84 TanStack npm package artifacts were compromised in the ongoing Mini Shai-Hulud supply chain attack, adding suspected CI credential-stealing malware. Socket flagged every malicious version within six minutes of publication. Details: socket.dev/blog/tanstac...

socket.devTanstack npm Packages Compromised in Ongoing Mini Shai-Hulud...Socket detected 84 compromised TanStack npm packages modified with suspected CI credential-stealing malware.

11/5/26, 10:11 pm43 reposts61 likes

Corbin Crutchley

@crutchcorn.dev

11 May

Just wanted to let people know that we just published our postmortem bsky.app/profile/crut...

Corbin Crutchley@crutchcorn.dev

tanstack.com/blog/npm-sup... Just published our postmortem

tanstack.comPostmortem: TanStack npm supply-chain compromise | TanStack BlogOn 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 mal...

Rasmus Ros

@rasros.bsky.social

12 May

the immediate cleanup is obvious. the harder part is provenance. if your CI minted tokens or published artifacts while the malicious postinstall ran, this is token rotation and artifact review, not just `npm install` whack-a-mole.