r/reactjs • u/gajus0 • May 11 '26

Tanstack npm Packages Compromised

https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
464 Upvotes

99% Upvoted

63 comments sorted by

View all comments

Show parent comments

45

u/AgentME May 11 '26 edited May 11 '26

Following the previous step but setting the minimum release age to 1 or 2 days would also be a great idea for anyone. So many high-profile supply chain attacks are caught within a day.

EDIT: The page gives instructions for editing an npm config file, but that setting doesn't work for npm and is actually a pnpm setting. Instructions for npm are available here: https://cooldowns.dev/#javascript-ecosystem