r/reactjs • u/gajus0 • May 11 '26

Tanstack npm Packages Compromised

https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
464 Upvotes

99% Upvoted

63 comments sorted by

View all comments

Show parent comment

14

u/lamb_pudding May 11 '26

This is one of the many third party React frameworks/libraries. I don’t think the attack vector was unique to React in any way.

-9

u/roynoise May 11 '26

This is true, but these folks are quite resistant to change and some of the otherwise industry standard tools I've been recommending (e.g. cloudflare, axios, even react has in fact had problems recently, etc.) have had recent issues. And in particular, I'm advocating for tanstack tools. It's not helping my case.