SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.
you are a new grad, you study comp sci and buy crypto as your ticket out of the permanent underclass
then, crypto goes to zero, AI destroys your career, and the boomers own all the houses
welcome to the new economy bucko
Solana is outperforming majors right now:
- Ethereum is technically inferior, overvalued
- Hyperliquid is going through unlocks + hungry competitors phase
- Zcash FUD, a lot of the flows came from Solana onchain in Q4, I can see a lot of it flow back into SOL
All of this is bringing back the question "so what is undeniably better to hold right now?"
The answer is $SOL and the market seems to agree
🚨BREAKING: Morgan Stanley, with $6.4T in assets under management, has filed an S-1 registration for the Morgan Stanley @Solana Trust ETF with the 🇺🇸 US SEC.
In the age of LLMs, it is now more and more accessible to create systematic investment processes; but to create one, you need to first be able to describe it.
As I saw on X somewhere recently, the most popular programming language of 2026 is english.
One of the most common question I get is what does a systematic investment process even look like? My goal is for you to understand enough to decide if you want to participate in the markets as a systematic investor.
Systematic investment processes are essentially pipelines that connects data to investment decisions. Every systematic strategy, no matter how sophisticated, follows the same fundamental architecture (with a few adjustments).
Data -> Features -> Signals -> Portfolio -> Execution
I wrote an article that discusses how a beginner might attempt to put this pipeline together so that he may start searching for signals to build his own systematic investment process.
(If you are interested in reading this, I will be giving out free articles to some retweets!)