Post #2442814

2026-05-11 21:02 UTC

“Socket detected 84 compromised TanStack npm package artifacts modified with suspected CI credential-stealing malware.” — @SocketSecurity https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack

Replies (1)

@zachleat@fediverse.zachleat.com 2026-05-12 00:05

And here is an absolute masterclass in writing a post-mortem from the team: https://tanstack.com/blog/npm-supply-chain-compromise-postmortem

Open ##2739570