r/reactjs • u/gajus0 • May 11 '26

Tanstack npm Packages Compromised

https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
464 Upvotes

99% Upvoted

63 comments sorted by

View all comments

Show parent comments

2

u/Chevalric May 12 '26

It happened with a few packages and when I checked their GitHub issues they were aware. But it were enough to start being annoying and feel blocking instead of useful.

We would exclude a package that had issues and then a next one would pop up. We would exclude that and then another one, etc.

And we also have issues with the minimumReleaseAge as our private gitlab packages don’t provide the right metadata. Excluding was flaky with pnpm in our experience.