corpus.blog
56,966 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a08219-63fa-70ed-98c0-9358bf866c65

Postmortem: TanStack npm supply-chain compromise

TanStack Blog · published 11 May 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at tanstack.com Wayback capture
25blogs citing
First cited
24 Jan 2026
Most recent
16 Jul 2026
Rank this month
not ranked
Links from this post
11
Words captured
2,595

Cited by

Blog
In the post
Date
blog.logrocket.com
How to secure full-stack projects from NPM attacks Read at the source ↗
16 Jul 2026
logrocket.com
How to secure full-stack projects from NPM attacks Read at the source ↗
16 Jul 2026
blog.logrocket.com
Why npm dependencies are a bigger security risk than your code Read at the source ↗
30 Jun 2026
logrocket.com
Why npm dependencies are a bigger security risk than your code Read at the source ↗
30 Jun 2026
johnsy.com
mise, aube, et cetera... Read at the source ↗
26 Jun 2026
blog.logrocket.com
Frontend Wrapped H1 2026: The nine biggest storylines so far Read at the source ↗
23 Jun 2026
logrocket.com
Frontend Wrapped H1 2026: The nine biggest storylines so far Read at the source ↗
23 Jun 2026
Red Canary
Intelligence Insights: June 2026 Read at the source ↗
18 Jun 2026
OpenSSF Blog
Mini Shai-Hulud: Where SLSA’s Boundaries Fall Read at the source ↗
10 Jun 2026
austen.info
Beyond the OIDC Silver Bullet: Why "Keyless" GitHub Actions Aren't Enough Read at the source ↗
3 Jun 2026
alexocallaghan.com
May Reading List Read at the source ↗
2 Jun 2026
xergioalex.com
Supply chain attacks in the AI era: the state of open source in 2026 Read at the source ↗
29 May 2026
Supabase Blog
Protecting your Supabase projects from npm supply chain attacks Read at the source ↗
26 May 2026
josephhall.org
Squeezing the Balloon: Why Securing the Open Source Build Process is Only the Beginning Read at the source ↗
23 May 2026
janlavicka.com
Beat NPM Supply Chain Attacks by Doing Nothing Read at the source ↗
22 May 2026
radval.me
npm install and pray. Axios and TanStack, 2026. Read at the source ↗
22 May 2026
Nx Blog
Postmortem: Nx Console v18.95.0 supply-chain compromise Read at the source ↗
21 May 2026
vulncheck.com
Quantifying 2026 Routinely Targeted Vulnerabilities (So Far) Read at the source ↗
21 May 2026
Julien Danjou
How Much Of A Library Do You Actually Use? Read at the source ↗
19 May 2026
Miguel's dev blog
Writing web services in the AI-era Read at the source ↗
17 May 2026
neciudan.dev
GitHub Actions Cache Poisoning is eating open source Read at the source ↗
17 May 2026
slsa.dev
Mini Shai-Hulud: Where SLSA’s Boundaries Fall Read at the source ↗
15 May 2026
opensourcemalware.com
The OpenSourceMalware Show #4 Read at the source ↗
14 May 2026
timbenniks.dev
The Mini Shai-Hulud supply chain backlash will create worse software Read at the source ↗
13 May 2026
Sourcegraph
How we're using Sourcegraph and a Slack bot to detect vulnerabilities and react quickly Read at the source ↗
13 May 2026
mend.io
Mini Shai-Hulud Is Back: 172 npm and PyPI Packages Compromised in Latest Wave Read at the source ↗
12 May 2026
Snyk
TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack Read at the source ↗
11 May 2026
Jacob E. Dawson
5 Quick Links for Devs: Week 20, 2026 Read at the source ↗
11 May 2026
christian-schneider.net
Dependency cooldowns: a simple supply chain fix Read at the source ↗
27 Jan 2026
christian-schneider.net
Ship fast, but guard faster: securing DevOps itself Read at the source ↗
24 Jan 2026

Links from this post

Link
Host
Hardening TanStack After the npm Compromise Read at the source ↗
tanstack.com
https://github.com/TanStack/router/issues/7383
github.com
https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
github.com
https://github.com/zblgg/configuration
github.com
https://github.com/TanStack/router/actions/runs/25613093674
github.com
https://github.com/TanStack/router/actions/runs/25691781302
github.com
The Monsters in Your Build Cache - GitHub Actions Cache Poisoning Read at the source ↗
adnanthekhan.com
https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
securitylab.github.com
https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
stepsecurity.io
https://docs.npmjs.com/policies/unpublish
docs.npmjs.com
https://docs.npmjs.com/generating-provenance-statements
docs.npmjs.com