TanStack reported a supply‑chain compromise affecting 42 @tanstack/* packages (84…

Brief

TanStack npm packages were compromised on 2026-05-12 with 42 @tanstack/* packages (84 malicious versions) published ~19:20–19:26 UTC; a git‑resolved optionalDependency (router_init.js ~2.3 MB) exfiltrates cloud and developer credentials. npm security is deprecating affected versions and pulling tarballs; Bun users should set "minimumReleaseAge" to avoid very recent malicious releases.

Why it matters

TanStack reported a supply‑chain compromise affecting 42 @tanstack/* packages (84 malicious versions total), published to npm at ~19:20 and ~19:26 UTC with two malicious versions per package; severity: HIGH — payloads exfiltrate AWS, GCP, Kubernetes, Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.

Key details

The malicious manifest contains an optionalDependencies entry pointing to "@tanstack/setup": "github:tanstack/router#79ac49ee..." and delivers a git‑resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB) smuggled into each tarball; npm unpublish is blocked, so all 84 versions are being deprecated and npm security is engaged.

@anthonyriera recommends Bun users set a "minimumReleaseAge" in Bun config because these attacks are typically detected within minutes; this setting would skip very recent releases and help avoid the compromised packages. If you installed any @tanstack/* between 19:20–19:30 UTC, rotate cloud/GitHub/SSH credentials, audit logs, and pin to a known‑good version.

If you use Bun a good way to prevent being affected by this is to set a "minimumReleaseAge" to your Bun config.

This type of attacks are generally catch within minutes of happening, so this simple config would keep you safe.

TANSTACK (@tan_stack)

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
github.com/TanStack/router/i…
Credit to the security researcher for responsible disclosure.

— https://nitter.net/tan_stack/status/2053948103766716630#m