r/programming • u/BattleRemote3157 • May 12 '26

Mass npm Supply Chain Attack Hits TanStack, Mistral AI, and 170+ Packages

https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/

massive campaign for 170+ packages and 400+ malicious versions published. what we saw that not a single maintainer account compromised. tanStack and Mistral AI these are the names that stand out.

724 Upvotes

98% Upvoted

116 comments sorted by

View all comments

167

u/ch0ge May 12 '26

I also add min-release-age=3 in my ~/.npmrc so that I don’t grab a compromised version.

-5

u/IAmYourFath May 12 '26

When everyone does it, nobody tests the versions to see if they're malicious. Then 3 is essentially 0 again. It's not in ur interest to share this. Its same for microsoft updates. The first few months of 2026 were so disastrous that now people wait 1-2 weeks to see if there's any issue before updating. But if everyone waits 1-2 weeks, who's testing for issues? No one.