External risk intelligence
TanStack npm packages could allow external attackers to steal credentials
TanStack packages could allow external attackers to distribute credential-stealing malware, potentially exposing sensitive data and developer credentials within your build pipelines. This confirmed supply chain incident means your development environments may have introduced compromised components.
Halo Surface Signal
1/ 5This vulnerability exists within the software supply chain and build pipeline processes, which are internal to development environments. It does not involve a public-facing network service, appliance, or gateway, as the risk is isolated to the ingestion and execution of third-party dependencies during the build lifecycle.
Exposure facts
H – Horizon Alert
An incident occurred where unauthorized actors compromised the publishing process for @tanstack software packages, allowing them to distribute malicious code under a trusted identity. By hijacking the project's credentials, the attackers inserted credential-stealing malware into updates that appeared legitimate to users. This creates a significant business risk, as organizations relying on these packages may have inadvertently introduced compromised components into their environments. This event underscores the critical nature of software supply chain integrity and the potential for trusted development tools to be weaponized against downstream users.
A – Asset Exposure
This supply chain incident impacts development environments and software build pipelines that ingest packages from the @tanstack ecosystem. If these packages are integrated into your applications, there is a risk that credential-stealing malware could be introduced, potentially compromising sensitive data or developer credentials. This risk is specific to the integrity of software dependencies and internal build processes, rather than being an exposure of a public-facing network service.
L – Live Threat
This incident involved a confirmed supply chain compromise where malicious, credential-stealing packages were published to the npm registry. Threat actors successfully leveraged legitimate authentication mechanisms to distribute this malicious code under a trusted identity during a specific window of time. While this incident resulted in verified malicious activity, the available context does not indicate ongoing or widespread targeting beyond this identified event.
O – Operational Fix
We recommend immediately auditing your project dependency lock files to identify and remove any instances of the compromised `@tanstack/*` packages. Please have your development teams update to the validated, secure versions identified in the official vendor security advisories and purge any cached build artifacts. Because this incident involved the potential for credential theft, we advise a proactive rotation of secrets that were present in any environment where these packages were utilized. Please continue to monitor official TanStack repository and advisory channels to ensure compliance with their latest recovery guidance.