TanStack npm packages

7 atoms · 跨 1 天 · 首见 2026-05-11 · 最近 2026-05-11

三色: 🟦 fact 7 · 🟥 take 0 · stance ▲0/▼7/◆0

来源: X 7

时态: fresh:7

标签: 好数字:3 · 好思考:2 · 好观点:1 · 好信源:1

事实 (fact) (7)

• 2026-05-11 · compromise time window
  If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised
  tags: 好思考 · → daily
  value: date=2026-05-11T19:20-19:30 UTC
• 2026-05-11 · malicious indicator
  Detection — the malicious manifest contains: "optionalDependencies": { "@tanstack/setup": "github:tanstack/router#79ac49ee..." }
  tags: 好思考 · → daily
• 2026-05-11 · supply-chain compromise affecting packages count
  A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
  tags: 好数字 · → daily
  value: qty=42
• 2026-05-11 · payload size
  _The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root)._
  tags: 好数字 · → daily
  value: qty=~2.3 MB
• 2026-05-11 · deprecated versions count
  All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
  tags: 好数字 · → daily
  value: qty=84
• 2026-05-11 · severity level
  Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
  tags: 好观点 · → daily
• 2026-05-11 · 被攻陷于 Mini Shai-Hulud 供应链攻击
  Several npm packages for the TanStack web development tools were compromised in the Mini Shai-Hulud supply chain attack
  tags: 好信源 · → daily

时间轴 (近 20)

• 2026-05-11 · fact · supply-chain compromise affecting packages count · → daily
• 2026-05-11 · fact · severity level · → daily
• 2026-05-11 · fact · compromise time window · → daily
• 2026-05-11 · fact · malicious indicator · → daily
• 2026-05-11 · fact · payload size · → daily
• 2026-05-11 · fact · deprecated versions count · → daily
• 2026-05-11 · fact · 被攻陷于 Mini Shai-Hulud 供应链攻击 · → daily

← 实体目录 · 系统日志