OIDC token extraction

npm supply chain compromise visualization showing malicious code injection chain across GitHub Actions cache and npm registry layers

TanStack npm Supply Chain Compromise: 84 Malicious Versions Detected Across 42 Packages

An attacker exploited three chained vulnerabilities to publish 84 malicious npm versions across 42 TanStack packages on May 11. Detection occurred within 20 minutes; all versions were deprecated and npm security was engaged.

Mohamed Ghamdi · 13 May 2026