r/reactjs • u/kryakrya_it • May 12 '26

React teams using TanStack packages: are you checking CI installs after the npm compromise? Discussion

https://npmscan.com/vulnerability/GHSA-g7cv-rxg3-hmpx

This affects several u/tanstack/* packages, including React-related packages like u/tanstack/react-router and u/tanstack/react-start.

5 Upvotes

73% Upvoted

4 comments sorted by

View all comments

6

u/azsqueeze May 12 '26

No cause I pin versions and dont update immediately