TanStack released a postmortem on May 29, 2026, detailing a compromise that affected 42 of its npm packages. The postmortem outlines the attack vector and recommends immediate security changes for all projects, including enabling two-factor authentication, auditing dependencies, and rotating credentials.
tanstack put out a postmortem for the 42-package npm compromise. they're telling everyone to turn on 2fa, audit deps, and rotate creds asap.
This incident underscores the fragility of the npm supply chain, where a single compromised account can cascade into dozens of malicious packages. TanStack's recommendations are a template for the entire JavaScript ecosystem to harden against similar attacks.
another reminder that npm is held together by tape and vibes. tanstack's postmortem is basically a checklist every project should follow this week.
Public story text does not change until an admin approves it.
Looped stories are not disposable posts: receipts, claims, reader checks, and moderator decisions can change the approved version over time.