TanStack Router npm Packages Compromised in Supply‑Chain Attack
Audit all TanStack router dependencies, update to the patched version, and remove any compromised packages from your build.
Run npm audit, pin TanStack router to a known safe version, and monitor for further advisories.
Summary
Several npm latest releases, including TanStack router, have been compromised in a self‑spreading supply‑chain attack. The incident, detailed by StepSecurity in a blog post titled "mini‑shai‑hulud," was reported on 11 May 2026 and remains under investigation. The attack affects the TanStack router package and potentially other npm packages, but no specific CVE or patch has been published yet. Developers are urged to audit their npm dependencies for integrity, update to the latest safe version once available, and monitor for further advisories. The compromised packages may have been altered to inject malicious code or backdoors, posing a risk to any project that relies on them. The incident underscores the importance of supply‑chain security and the need for vigilant dependency management.
Immediate action is required to prevent potential exploitation of compromised packages in production environments.
Key changes
- Several npm latest releases, including TanStack router, are compromised
- The compromise is a self‑spreading supply‑chain attack
- StepSecurity blog details the incident (mini‑shai‑hulud)
- Issue opened on 11 May 2026 with no patch yet
- TanStack router affected; other packages may be impacted
- No specific advisory or CVE published yet
- Developers should audit npm dependencies for integrity
- Update to the latest safe version once available