TanStack NPM Packages Compromised
Summary
Reports indicate a security compromise affecting TanStack NPM packages, impacting developers using the TanStack Router and Start frameworks.
View Cached Full Text
Cached at: 05/11/26, 09:53 PM
TanStack/router
Source: https://github.com/TanStack/router
|
TanStack RouterA modern router designed for type safety, data‑driven navigation, and seamless developer experience.
Read the Router Docs → |
TanStack StartA full‑stack framework built on Router, designed for server rendering, streaming, and production‑ready deployments.
Read the Start Docs → |
Get Involved
- We welcome issues and pull requests!
- Participate in GitHub discussions
- Chat with the community on Discord
- See CONTRIBUTING.md for setup instructions
Partners
|
|
|
|
|
|
|
|
|
We're looking for TanStack Router & Start Partners to join our mission! Partner with us to push the boundaries of TanStack Router & Start and build amazing things together.
LET'S CHATExplore the TanStack Ecosystem
- TanStack Config – Tooling for JS/TS packages
- TanStack DB – Reactive sync client store
- TanStack DevTools – Unified devtools panel
- TanStack Form – Type‑safe form state
- TanStack Pacer – Debouncing, throttling, batching
- TanStack Query – Async state & caching
- TanStack Ranger – Range & slider primitives
- TanStack Store – Reactive data store
- TanStack Table – Headless datagrids
- TanStack Virtual – Virtualized rendering
… and more at TanStack.com »
Similar Articles
@tan_stack: SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @tanstack/* packages (84 versions tota…
A high-severity supply-chain compromise affected 42 TanStack npm packages, exfiltrating cloud credentials and SSH keys. Users are advised to rotate credentials and reinstall from clean lockfiles if they installed packages during the attack window.
Postmortem: TanStack npm supply-chain compromise
Detailed postmortem of a supply-chain attack on TanStack's npm packages involving cache poisoning, OIDC token extraction, and credential harvesting malware. All affected versions deprecated; users advised to rotate credentials.
Our response to the TanStack npm supply chain attack
OpenAI responds to the TanStack npm supply chain attack, stating that no user data or production systems were compromised, but two employee devices were impacted and limited credentials exfiltrated from internal code repositories.
Grafana Labs GitHub repos breached via TanStack npm supply chain attack
Grafana Labs disclosed that a cybercrime group gained unauthorized access to its GitHub repositories via a TanStack npm supply chain attack, downloading codebase and internal data, but no customer production systems were compromised.
@DeRonin_: USE THIS GUIDE TO PROTECT YOUR COMPUTER FROM NPM HACKS THAT STEAL EVERYTHING IN ONE INSTALL TanStack, a code library us…
The article details a supply-chain attack on the TanStack library via NPM, offering a comprehensive guide to protect development environments by locking dependency ages, pinning versions, and auditing CI/CD pipelines and IDE extensions.