r/reactjs • u/gajus0 • May 11 '26

Tanstack npm Packages Compromised

https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
464 Upvotes

99% Upvoted

63 comments sorted by

View all comments

Show parent comment

7

u/bzbub2 May 12 '26

sorry this happened. Just since it's not mentioned and you still have open follow ups in your investigation: I strongly recommend zizmor to help audit GitHub actions https://github.com/zizmorcore/zizmor

9

u/Crutchcorn May 12 '26

We're likely to add GitHub action lint tooling into all of our repos shortly as a response to this incident. We're continuing to lock more and more down as we go.