TLDR Tech / InfoSec
TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply-Chain Attack
84 TanStack npm packages have been compromised in an ongoing supply-chain attack. Several of these packages have over 12 million weekly downloads, making the compromise especially significant from a software supply-chain perspective. TanStack has deprecated the affected versions, engaged npm security to pull the malicious tarballs, purged GitHub Actions cache entries, and merged hardening changes to restructure the affected workflow, add repository-owner guards, and pin third-party action references. A list of recommended actions for affected systems is available in the article.
Read the full story