This page summarizes the TanStack npm supply chain compromise associated with the ongoing “Mini Shai-Hulud” campaign.
The incident involved compromised npm packages published under the `@tanstack/*` namespace, along with additional npm packages. The compromised packages reportedly included mechanisms for persistence and further supply chain propagation through malicious package publishing activity.
You can use this page to identify affected package versions and review recommended remediation actions.
For additional background and technical details, please refer to the “Snyk Blog post”.
Packages affected by zero-day vulnerabilities
Showing 30 of 172 • Page 1 of 6
- C
- C
- C
Embedded Malicious Code in ml-toolkit-ts (npm)- C
Embedded Malicious Code in @supersurkhet/cli (npm)- C
- C
Embedded Malicious Code in safe-action (npm)- C
Embedded Malicious Code in @draftlab/auth (npm)- C
- C
Embedded Malicious Code in @tolka/cli (npm)- C
- C
- C
Embedded Malicious Code in @dirigible-ai/sdk (npm)- C
- C
- C
- C
- C
- C
- C
- C
- C
- C
- C
- C
- C
- C
Embedded Malicious Code in @uipath/flow-tool (npm)- C
- C
Embedded Malicious Code in @uipath/robot (npm)- C
- C
Page 1 of 6