TanStack npm Supply Chain Compromise - Exposure: @tanstack Package Installs in M

Montaser Ismail@M0nt3x

•updated Aug 31, 2026•1•0•3

Detects package installation activities involving potentially compromised TanStack packages during the defined malicious publish window (2026-05-11 to 2026-05-12). The rule monitors common Node.js package managers (npm, pnpm, yarn, bun) and CLI tools for commands attempting to fetch identified affected versions of @tanstack/* libraries.