Flo

[TANSTACK @tan_stack]

New in TanStack Router: more control over dynamic route params.

Use params.parse to accept or skip a candidate, with priority for overlapping dynamic params.

[TANSTACK @tan_stack]

After a very thorough 3 day full security sweep and hardening process, we'd like to issue an official all clear ✅ on TanStack repo and package security. Full details have been updated in our post-mortem and security followup blog (linked below).

TL;DR:

- Only the Router/Start repo was affected. 42 monorepo packages, 2 versions per package. These were promptly deprecated within the hour and removed by NPM shortly after

- All other repos and packages were unaffected and remain secure including: Query, DB, Store, AI, Table, Form, HotKeys, Virtual, Pacer, Config, Devtools, CLI, Intent, etc.

- All available and published versions of every TanStack package are safe to download, including TanStack Router/Start.

https://t.co/KQSXhUM4XM
https://t.co/mtN9hF5Ioy

[TANSTACK @tan_stack]

"Hardening TanStack After the npm Compromise", a followup to yesterday's post-mortem.

https://t.co/KDZQCrgfOe

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[Flo @ChaponFlo]

@zshrm @tannerlinsley @brenelz If you're serious, my DMs are open

[Corbin Crutchley @crutchcorn]

.@ChaponFlo is one of our most valuable maintainers on TanStack, easily. Tanner's assessment of being in top 1% of talent is an understatement.

He not only ships incredible code, but is a fantastic communicator and knows how to self-motivate to get the job DONE. Highly rec.

[Flo @ChaponFlo]

@tannerlinsley And check out some of the stuff I've been working on, we have some good blog posts https://t.co/7CoLiCTh7C

[Flo @ChaponFlo]

@tannerlinsley Thank you for the endorsement, I'm so hyped 🙌

[Flo @ChaponFlo]

@6789Blazing @tannerlinsley It's sheraff on GitHub

[Tanner Linsley @tannerlinsley]

One of our core TanStack Start/Router team, @ChaponFlo, is looking for his next full-time remote position.

Easily top 1% talent, highly skilled in perf, dev-facing tools, TS, full-stack, etc (including TanStack, obviously 😉)

If hiring, DM him. If not, spread the word.

[Flo @ChaponFlo]

@glenathan @csswizardry Are there bundlers that actually do this (automatically)? Vite doesn't.

[Flo @ChaponFlo]

@antfu7 @nuxtlabs @voidzerodev Can I help? I love devtools and vite, I'm a good TS dev. `sheraff` on github if you want to check me out.

[Flo @ChaponFlo]

@jaffathecake @Rich_Harris It doesn't have to be this way though: https://t.co/Jc4EJ56neb

[Autoprefixer @Autoprefixer]

Autoprefixer 10.2.1 was released. @ChaponFlo fixed transition-property warning.

https://t.co/qBddDY0Mpa

Release’s knight by Michael MacRae.
https://t.co/Mwgkz5C2CA

[Flo @ChaponFlo]

Damn it. I'm screaming into the void of Internet again...

[Flo @ChaponFlo]

@mattsurely Hey welcome to the world of online funny chart makers :-)