TanStack npm Packages Compromised in Ongoing Supply-Chain Attack

Reported 12 May 2026 by otx · Severity: medium

Socket detected 84 compromised TanStack npm package artifacts modified with credential-stealing malware targeting CI systems, including GitHub Actions. Affected packages like @tanstack/react-router have over 12 million weekly downloads. The malicious versions contain router_init.