aikido.devwriteupPopular code generator for TanStack Query hit by supply chain worm
Aikido Security details a self-propagating npm worm that compromised a popular TanStack Query code generator package, injecting malicious postinstall scripts that harvest secrets and republish themselves to other packages maintained by infected developers. The incident reflects a broader wave of npm supply-chain worm attacks hitting widely-used JavaScript tooling.
TL;DR A TanStack Query codegen npm package was hit by a self-propagating supply-chain worm that steals credentials and spreads to other packages.
Technologies named here
- npm
- Node.js
- TanStack Query
Related in Supply Chain
