TanStack says several latest npm package releases were compromised in a broader self-spreading supply-chain attack

TanStack disclosed that several of its latest npm package releases were compromised and opened a GitHub issue to track the incident. The project pointed users to StepSecurity’s analysis of the self-spreading supply-chain attack and later published a postmortem with its findings and attack timeline.

The incident highlights how quickly npm compromises can propagate when trusted packages and release workflows are targeted. It reinforces the need for stronger package provenance, token hygiene, and automated dependency monitoring across open-source ecosystems.