🚨 There was another supply chain attack, this time affecting tanstack npm packages. Make sure you haven't installed the compromised packages either in your CI or locally.
I would also hold off on updating any dependency for the next week or so until the dust settles from this.
Blog post with more information on all of this. Stay safe out there!
https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
Anže
npub15w…8rte4
2026-05-11 22:44:55 UTC
Author Public Key
npub15wdfr9znyzrrucep9sa57p4p823cpue65gch3r83wtn8qxax2l6qw8rte4Seen on
wss://relay.momostr.pinkPublished at
2026-05-11 22:44:55 UTCEvent JSON
{
"id": "4aab1c9ca24c307a22452598fb772b53416db14131b5f81ac35ecf89ea28e6aa",
"pubkey": "a39a91945320863e63212c3b4f06a13aa380f33aa231788cf172e6701ba657f4",
"created_at": 1778539495,
"kind": 1,
"tags": [
[
"proxy",
"https://fosstodon.org/@anze3db/116558364408886679",
"web"
],
[
"proxy",
"https://fosstodon.org/users/anze3db/statuses/116558364408886679",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://fosstodon.org/users/anze3db/statuses/116558364408886679",
"pink.momostr"
],
[
"-"
]
],
"content": "🚨 There was another supply chain attack, this time affecting tanstack npm packages. Make sure you haven't installed the compromised packages either in your CI or locally.\n\nI would also hold off on updating any dependency for the next week or so until the dust settles from this.\n\nBlog post with more information on all of this. Stay safe out there!\n\nhttps://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack",
"sig": "f7a2d28ba60518124acc77b7d444b60e625c143adbd292893a16f59534bfb13c0db3b19ce351d1ddceb739782883f9ca2ecdb42464412ddcc8e8a5bd814a9eef"
}