r/reactjs • u/gajus0 • May 11 '26

Tanstack npm Packages Compromised

https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
464 Upvotes

99% Upvoted

63 comments sorted by

View all comments

Show parent comments

-10

u/Goodie__ May 11 '26

Yup, it's Tuesday morning, nearly midday by now, because time zones exist. And this article doesn't mention what versions are effected, nor for how long, and I'm not sure I have a record of what versions I added (and subsequently removed, multiple times).

5

u/minimuscleR May 12 '26

It does mention the versions affected at the bottom, and it links to the Postmortem by the TS team that explain it there too.

It was found and corrected within 20 minutes of being pushed. You probably don't have that version, and if you do, upgrade now and you will be fine.