Postmortem: Nx Console v18.95.0 supply-chain compromise (opens in new tab)

Covers 3 stories including Postmortem: TanStack NPM supply-chain compromiseCovered by 4 sources including Andrew Nesbitt, heise onlineDiscussed on r/vscode

Full postmortem of the malicious Nx Console v18.95.0 published to Visual Studio Marketplace and Open VSX on 2026-05-18, originating from the TanStack npm supply-chain compromise that exfiltrated a contributor's gh CLI OAuth token seven days earlier.

Read the original article

Sign in to keep reading the full article.

Sign Up Log In

Covered in 4 articles

Andrew Nesbitt·

This Week in Package Management: 23 May 2026

reactiflux.com·

TMiR 2026-05: Who even is on the Core team anymore, TanStack got pwn'd bad

Discussed on r/reactjs

cisa.gov·

Supply Chain Compromises Impact Nx Console and GitHub Repositories

View all 4 ›