🧰 tanstack

The items that name it 21

• Software supply chain security best practices for 2026
  articleas classification.key entities2026-10-21
• How a Misconfigured CI Workflow Became an npm Supply-Chain Compromise | Blog | Endor Labs
  writeupas classification.key entities2026-10-12
• Happy Birthday, Shai-Hulud
  articleas affected products2026-09-18

  Project hit by the May 2026 Mini Shai-Hulud burst

• GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
  articleas classification.technologies2026-09-16
• The Evolution of JFrog AI Catalog: Your AI Control Plane for Agentic Development
  articleas affected products2026-09-02
• Shai-Hulud was the best thing to happen to supply chain security
  articleas affected products2026-08-24

  Targeted in Mini Shai-Hulud II, May 7-11, 2026; OIDC token extracted from GitHub Actions runner memory despite Trusted Publishing

• Socket: How AI Agents Expand the Software Supply Chain Attack Surface
  talkas affected products2026-08-17

  supply chain attack incident referenced

• Thinkst Package Proxy
  toolas affected products2026-06-26

  Package/project affected by a recent breach that Package Proxy's age checks prevented from impacting Thinkst

• Socket: actions/checkout v7 Blocks Unsafe pull_request_target Checkouts
  articleas classification.technologies2026-06-22
• Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files
  articleas affected products2026-06-18

  prior supply chain compromise StepSecurity was officially credited for discovering (mentioned as past track record)

• Microsoft's durabletask PyPI Package Compromised in Supply Chain Attack
  writeupas affected products2026-06-09It is written here as TanStack (npm packages).

  42 npm packages compromised, associated with CVE-2026-45321, CVSS 9.6

• Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents
  writeupas affected products2026-06-09It is written here as TanStack (42 npm packages).

  42 npm packages

• Miasma: Supply Chain Attack Targeting RedHat npm Packages
  writeupas affected products2026-06-01

  Previously targeted by TeamPCP in an attack that also included production of valid SLSA provenance attestations

• Socket: Mini Shai-Hulud
  articleas classification.technologies2026-05-22
• Socket: TanStack npm Packages Compromised
  writeupas classification.technologies2026-05-20
• Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages
  articleas classification.key entities2026-05-19
• FOSSA: Mini-Shai-Hulud Mass Compromise
  writeupas classification.technologies2026-05-18
• Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack
  writeupas classification.technologies2026-05-11
• TanStack npm Brand-Squat
  writeupas affected products2026-05-06It is written here as tanstack (unscoped npm package).

  brand-squatted impersonation of the official @tanstack/* scope; not affiliated with the legitimate TanStack project

• Sigma r2026-07-01 — 20 new detection rules
  repoas affected productsIt is written here as TanStack (npm package).

  Target of supply-chain attack covered by five new detection rules across Windows and Linux

• Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages
  articleas classification.technologies