Urgent.News

What's breaking now, across thousands of outlets.

More in Tech

TanStack npm supply-chain attack: how a Dependabot bump spread a worm

On May 11, 2026, a worm published 84 malicious versions of 42 TanStack packages to npm, with valid provenance, from TanStack's own release pipeline.

  • Malicious worm infiltrated 84 TanStack npm packages on May 11, 2026
  • Dependabot pull request introduced compromised versions into aviation project
  • Worm used publish token to create 110 malicious versions within 95 minutes

More from Thursday 1 October →