Hosted on MSN

The TanStack supply chain attack hit OpenAI — hackers reached two employee devices and forced the company to rotate all its code-signing certificates

When OpenAI engineers discovered that a poisoned update to a widely used JavaScript library had executed on two corporate laptops, the company’s security team faced a decision that no software ...
Hosted on MSN

The TanStack supply chain attack poisoned 160 npm and PyPI packages — reaching OpenAI, Mistral AI, and UiPath through compromised build pipelines

On May 11, 2026, a self-replicating worm called Mini Shai-Hulud quietly slipped into 42 widely used TanStack open-source packages, corrupting 84 npm artifacts before anyone noticed. Within hours, the ...
PC Magazine

OpenAI Tells Mac Users to Update Apps After Software Supply Chain Attack

Tanstack reports that three vulnerabilities were abused and chained together to upload the malicious versions. Disclosure: Ziff Davis, PCMag's parent company, filed a lawsuit against OpenAI in April ...
BleepingComputer

GitHub links repo breach to TanStack npm supply-chain attack

GitHub says the hackers who breached 3,800 internal repositories gained access via a malicious version of the Nx Console VS Code extension, compromised in last week's TanStack npm supply-chain attack.
InfoQ

TanStack Releases TanStack Form V1

Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with content, and download exclusive resources. Brian Martin discusses the real-world ...
BleepingComputer

Shai Hulud attack ships signed malicious TanStack, Mistral npm packages

Hundreds of packages across npm and PyPI have been compromised in a new Shai-Hulud supply-chain campaign delivering credential-stealing malware targeting developers. The attacker hijacked valid OpenID ...
17173游戏网

npm 生态遭大范围投毒：TanStack、Mistral AI、UiPath 等受波及，可窃取云密钥与 GitHub 令牌

NPM生态遭大规模供应链攻击！TanStack、Mistral AI、UiPath等160+软件包被投毒，恶意代码窃取AWS/GCP密钥、GitHub令牌。立即查看受 ...