SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
github.com/TanStack/route…
Credit to the security researcher for responsible disclosure.
812 Followers 592 FollowingAWS設計構築・バックエンド少々←SRE←バックエンド(1年) ←教師←国税34歳未経験からエンジニア 誠実に謙虚に貪欲に 37歳 子2人(4、7🦏) 子育てフルコミット 福岡在住 フルリモート 現場での学びや日常などつぶやきます 家事職人 AWS SAA DVA SOA DOP SAP ルビコン塾
1.4M Followers 2 FollowingClaude is an AI assistant built by @anthropicai to be safe, accurate, and secure. Talk to Claude on https://t.co/ZhTwG8d1e5 or download the app.
1.3M Followers 2 FollowingWe're an AI safety and research company that builds reliable, interpretable, and steerable AI systems. Talk to our AI assistant @claudeai on https://t.co/FhDI3KQh0n.
4.9M Followers 4 FollowingOpenAI’s mission is to ensure that artificial general intelligence benefits all of humanity. We’re hiring: https://t.co/dJGr6LgzPA
1.1M Followers 172 FollowingNobel Laureate. Co-Founder & CEO @GoogleDeepMind - working on AGI. Solving disease @IsomorphicLabs. Trying to understand the fundamental nature of reality.
13K Followers 561 Following@Microsoft AI Cloud Solution Architect / Microsoft Evangelist / 上智大学 大学院 応用データサイエンス学位プログラム 非常勤講師
GPTなどAI技術導入の支援、LLM開発の執筆・登壇、生成AI関連の講義などに従事。Posts on my own.
304 Followers 167 FollowingSenior ServiceNow Recruitment Consultant based in Austin, TX - connecting the best ServiceNow talent with clients across North America! - [email protected]