Post

woah look out

⚠️ If you use any TanStack package in any of your projects and there's any chance any of them was updated today, stop what you're doing and read this. ... Actually there are 121 non-tanstack packages affected as well, so check the list anyway.

Corbin Crutchley

@crutchcorn.dev

tanstack.com/blog/npm-sup... Just published our postmortem

tanstack.comPostmortem: TanStack npm supply-chain compromise | TanStack BlogOn 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 mal...

11/5/26, 11:43 pm9 reposts30 likes

dan

@danabra.mov

11 May

thanks for being so quickly on top of this, sounds extremely stressful!

Corbin Crutchley

@crutchcorn.dev

11 May

Thank you. The whole team came together as soon as we got the issue. We're still in a VC with ~10 maintainers, including Tanner. Whole team's making sure we're taking care of this properly.