Back to article

TanStack npm Packages Hit by Mini Shai-Hulud (opens in new tab)

Covers 5 stories including Postmortem: TanStack NPM supply-chain compromiseCovered by 6 sources including This Week In 4n6, evahill1.substack.com

Covers 5 related stories

TanStack Blog·

Postmortem: TanStack NPM supply-chain compromise

Discussed on Hacker News, Hacker News, Lobsters, r/netsec, r/programming, and DEV

stepsecurity.io·

Mini Shai-Hulud - TanStack and more npm packages compromised, with SLSA Build Level 3 provenance attestations

Discussed on Lobsters

Tanstack NPM Packages Compromised in Ongoing Supply-Chain Attack

Discussed on Hacker News and r/reactjs

The npm Threat Landscape: Attack Surface and Mitigations

Widespread Supply Chain Compromise Impacting NPM Ecosystem

Discussed on Hacker News

Covered in 7 articles

This Week In 4n6·

Week 20

evahill1.substack.com·

The vulnerability bottleneck has moved

Discussed on Substack

venturebeat.com·

GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK

venturebeat.com·

Four AI supply-chain attacks in 50 days exposed the release pipeline red teams aren't covering

Grafana Labs security update: Latest on TanStack npm supply chain ransomware incident

Discussed on Hacker News and Lobsters

Perplexity Built a Tool That Checks Your Computer for Infected Software—Without Setting Off the Infection

Mini Shai-Hulud: Frequently asked questions about the TeamPCP npm and PyPI supply chain campaign