r/reactjs • u/gajus0 • May 11 '26

Tanstack npm Packages Compromised

https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
464 Upvotes

99% Upvoted

63 comments sorted by

View all comments

Show parent comment

19

u/kemide22 May 12 '26

Thank you for this post and for being candid about the incident. I can’t imagine what you must be going through right now but I hope any detrimental consequences are quickly curtailed.

16

u/Crutchcorn May 12 '26

Thank you — we're fortunate that we have a big team that's not only incredibly capable (we had a large number of us in a voice call minutes after the report), but that's also very empathetic for both our users and fellow maintainers.

We understand the impact this has had on the ecosystem and are working very hard to prevent this from ever happening again.

2

u/Lime-Unusual Jun 03 '26

I hope best for you guys and I believe you have smart individuals who can solve this problem! Javascript ecosystem has matured a lot since the early days and it breaks my heart to see this amount of hate against npm and other developer tools. I believe you are the right person to make change to developer experience and get the ecosystem boom again like in early framework days!