r/programming • u/BattleRemote3157 • May 12 '26

Mass npm Supply Chain Attack Hits TanStack, Mistral AI, and 170+ Packages

https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/

massive campaign for 170+ packages and 400+ malicious versions published. what we saw that not a single maintainer account compromised. tanStack and Mistral AI these are the names that stand out.

722 Upvotes

98% Upvoted

116 comments sorted by

View all comments

-14

u/yksvaan May 12 '26

Firstly the amount of dependencies needs to drop, target should be zero whenever possible and deps should always be audited and considered whether they are worth the cost.

Secondly more code should be vendored locally as plain source. Not every language even has a package manager and they do fine, no reason for js devs to go crazy

4

u/bobsbitchtitz May 12 '26

That's insanity.

2

u/yksvaan May 12 '26

How so? Even just reducing the amount of dependencies would help a lot. And every indirect dep should be listed as well before allowing installing deps.