TANSTACK NPM PACKAGES COMPROMISED

INDUSTRY DESK■ 1 MIN READ

MON, MAY 11, 2026

■ AI-SUMMARIZED FROM 1 SOURCE ▸ TIMELINE

Popular TanStack NPM packages were compromised, affecting developers who use the widely-adopted routing and utility libraries. The vulnerability was reported on the TanStack Router GitHub issue tracker.

TanStack, known for maintaining several high-profile NPM packages including Router and Query, experienced a security breach affecting its package distribution. The compromise was disclosed through GitHub issue #7383 on the TanStack Router repository. The incident generated significant attention in the developer community, with the GitHub issue receiving 236 upvotes and 62 comments on Hacker News, indicating widespread concern among affected users. Details regarding the scope of the compromise, specific packages impacted, and remediation steps remain under investigation. Developers using TanStack packages should monitor official channels for security advisories and guidance on verifying package integrity. No statement has yet been released on the attack vector or whether malicious code was injected into live packages. Users are advised to check their dependency versions and security scanning tools for potential indicators of compromise.

■ SOURCES

► Hacker News

■ SUMMARY WRITTEN BY AI FROM THE LINKS ABOVE

■ MORE FROM THE SECURITY DESK

P166ANDROID-IPHONE TEXTS NOW END-TO-END ENCRYPTED

Cross-platform text messaging between Android and iPhone users can now be encrypted. Google's years-long push for Apple to adopt RCS texting has finally materialized into improved security.

JUST NOW— Industry Desk

P157YARBO REMOVES BACKDOOR FROM ROBOT LAWN MOWER

Yarbo plans to completely remove remote backdoor access from its robot lawn mower following security concerns. The feature will no longer be installed by default, with customers able to opt in if desired.

1H AGO— Industry Desk

P152CHECKMARX JENKINS PLUGIN COMPROMISED WITH INFOSTEALER

Checkmarx discovered a malicious version of its Jenkins Application Security Testing (AST) plugin published on the official Jenkins Marketplace. The rogue package contained infostealer malware designed to harvest sensitive data.

1H AGO— Industry Desk

P153GHOSTLOCK TOOL EXPLOITS WINDOWS API TO BLOCK FILES

A security researcher has released GhostLock, a proof-of-concept tool that abuses legitimate Windows file APIs to deny access to local and network-shared files. The vulnerability demonstrates a critical gap in how Windows handles file permissions.

1H AGO— Dev Desk

◄ BACK TO NEWS

TANSTACK NPM PACKAGES COMPROMISED

■ MORE FROM THE SECURITY DESK

■ SUBSCRIBE TO THE DAILY BRIEF