🧰 TanStack npm packages

The items that name it 5

• How a Misconfigured CI Workflow Became an npm Supply-Chain Compromise | Blog | Endor Labs
  writeup2026-10-12It is written here as @tanstack/* npm packages (42 packages, 84 malicious versions, published May 11, 2026).

  42 packages, 84 malicious versions, published May 11, 2026

• Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm
  writeup2026-06-01

  affected in May 12, 2026 Mini Shai-Hulud campaign hitting over 160 packages

• Socket: Mini Shai-Hulud
  article2026-05-22

  42 packages compromised May 11, 84 malicious versions total, including @tanstack/react-router (12 million weekly downloads)

• FOSSA: Mini-Shai-Hulud Mass Compromise
  writeup2026-05-18It is written here as @tanstack/* npm packages.

  42 packages compromised, including @tanstack/react-router (12M+ weekly downloads), @tanstack/vue-router, eslint plugins, query, history, store; malicious optionalDependencies entry (e.g. @tanstack/setup pointing to github:tanstack/router#<orphan-commit>); some tarballs include ~2.3MB obfuscated rout

• Dev Machine Guard Now Supports Windows - StepSecurity
  article