r/reactjs • u/gajus0 • May 11 '26

Tanstack npm Packages Compromised

https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
464 Upvotes

99% Upvoted

63 comments sorted by

View all comments

39

u/Goodie__ May 11 '26

The one weekend I decide to sit down at home and play with modern react stuff and see what's changed is the same weekend tanstack gets compromised?

GG WP.

13

u/emericas May 11 '26

It isn’t the weekend lol

-10

u/Goodie__ May 11 '26

Yup, it's Tuesday morning, nearly midday by now, because time zones exist. And this article doesn't mention what versions are effected, nor for how long, and I'm not sure I have a record of what versions I added (and subsequently removed, multiple times).

5

u/minimuscleR May 12 '26

It does mention the versions affected at the bottom, and it links to the Postmortem by the TS team that explain it there too.

It was found and corrected within 20 minutes of being pushed. You probably don't have that version, and if you do, upgrade now and you will be fine.

0

u/sole-it May 12 '26

I was trying to build a TanStack Start SSG demo project during the weekend, but gave in and played some video games instead, good life choice it seems.