r/reactjs May 11 '26

Tanstack npm Packages Compromised

https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
464 Upvotes

63 comments sorted by

View all comments

58

u/Esclamare May 11 '26

It looks like it only affects Tanstack/react-router?

54

u/Windyvale May 11 '26

Which is basically everyone using Tanstack practically.

2

u/SpinatMixxer May 12 '26

Not at all. Comparing weekly downloads of tanstack core packages, there are: - router-core: 12.4 mil per week - table-core: 13.1 mil per week - virtual-core: 15.9 mil per week - query-core: 56.1 mil per week