#Tanstack

Vercel now detects and deploys TanStack Start, a full-stack framework powered by TanStack Router for React and Solid.

This post is part of my weekly newsletter - Top 5 in Frontend and AI. Subscribe so you can deep dives...

Attackers stole a limited amount of internal credential material after malware hidden in poisoned packages reached two staff machines

The Mini Shai-Hulud worm compromised 84 @tanstack packages in six minutes, bypassing valid OIDC provenance and 2FA. Here is exactly what LucidShark SCA surfaces in your editor before the malicious payload runs.

From Dev.to - security: GHSA-9M65-766C-R333: GHSA-9M65-766C-R333: Type Confusion in Seroval Leading to Unintended Function Execution in TanStack Start

On April 28, 2026, pnpm 11 was released with some of the strongest security defaults we've seen from...

A deep technical breakdown of the May 2026 TanStack supply chain attack. 84 malicious package versions were published through TanStack's own trusted CI pipeline. Here's the full attack chain, IOCs, and step-by-step remediation.

From Dev.to - cybersecurity: Supply Chain Worm Compromises Mistral AI, Guardrails AI and TanStack Packages

How the TanStack npm compromise fits into the broader Mini Shai-Hulud campaign across npm, PyPI, GitHub Actions, IDE hooks, and CI/CD secrets.

A page can load quickly and still feel unstable. That usually happens when the initial render...

The first time you try to test a TanStack app the way the React Testing Library docs suggest, the...

Ever had that sinking feeling when you realize your project's been compromised? It's like finding out...

The TanStack npm ecosystem was hit by a supply chain attack that hijacked legitimate build pipelines to distribute malware with valid SLSA provenance.…

Six-minute supply chain blitz pushed 84 malicious versions with credential theft and disk-wiping code

The TanStack npm compromise wasn't sophisticated — one maintainer's token was enough. Here are the three changes that actually shrink your blast radius.

TanStack npm Supply-Chain Attack: Full Postmortem - Complete guide and honest review for 2026.

From Dev.to - security: CVE-2026-45321: CVE-2026-45321: Critical Supply Chain Compromise in @tanstack Packages via GitHub Actions Misconfiguration

When you go API-First, your OpenAPI contract should be the single source of truth across your entire...

I work on Formisch, so I'm obviously biased. We published this comparison on our blog last month and...