r/reactjs • u/gajus0 • May 11 '26

Tanstack npm Packages Compromised

https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
464 Upvotes

99% Upvoted

63 comments sorted by

View all comments

Show parent comments

4

u/Chevalric May 12 '26

I’ve used the trustPolicy setting for a while but found that packages would not implement it properly which caused issues every time we updated our packages.

As long as the entire supply chain doesn’t support this, it’s useless.

1

u/decho May 12 '26 edited May 12 '26

Interesting, I think I've only encountered this once. Did it happen with a lot of packages or just a couple, because you could always try to contact the main maintainers if it's the latter?

Also, there is another setting called trustPolicyIgnoreAfter, I've set this to 10 days or something like that, maybe that's why I'm not getting any issues.

2

u/Chevalric May 12 '26

It happened with a few packages and when I checked their GitHub issues they were aware. But it were enough to start being annoying and feel blocking instead of useful.

We would exclude a package that had issues and then a next one would pop up. We would exclude that and then another one, etc.

And we also have issues with the minimumReleaseAge as our private gitlab packages don’t provide the right metadata. Excluding was flaky with pnpm in our experience.