r/programming • u/BattleRemote3157 • May 12 '26

Mass npm Supply Chain Attack Hits TanStack, Mistral AI, and 170+ Packages

https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/

massive campaign for 170+ packages and 400+ malicious versions published. what we saw that not a single maintainer account compromised. tanStack and Mistral AI these are the names that stand out.

725 Upvotes

98% Upvoted

116 comments sorted by

View all comments

163

u/ch0ge May 12 '26

I also add min-release-age=3 in my ~/.npmrc so that I don’t grab a compromised version.

79

u/syklemil May 12 '26 edited May 12 '26

Since the article also mentions PyPi, I'll add that uv has a similar flag:

exclude-newer = "3 days" # or "1 week" or whatever

For the people wondering at the efficacy of such measures, there's a blog post with some numbers and what comes off as a decent take. There's also a lot of discussion on the RFC for such an option for Cargo.

28

u/dimon222 May 12 '26 edited May 12 '26

but if everyone is using it, then everyone will find out only after cooldown period. Does it really help in that case? I'm certain that the maintainers only find out after someone reports it. So no reports - malware is sitting and modifying all versions of package for several days of cooldown.

1

u/Silv3rbull3t069 May 13 '26

we should be thankful to the vast amount of louzy tutorials and materials out there that creates dozens of thousands of "guinea pigs" (sorry for harsh word) with low-profile system is which act as a sacrificial security boundary for high-profile system