🧰 @tanstack/* packages

The items that name it 3

• GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
  article2026-09-16

  84 malicious versions published across 42 @tanstack/* packages in May 2026, via cache poisoning chained with a pull_request_target pwn request

• Socket: actions/checkout v7 Blocks Unsafe pull_request_target Checkouts
  article2026-06-22

  42 packages affected, 84 malicious versions published in TanStack compromise

• Dev Machine Guard Now Supports Windows - StepSecurity
  articleIt is written here as TanStack packages.

  npm packages affected by the Mini Shai-Hulud wave