Karas

Fullstack engineer & AI researcher | Building AI-native apps that feel alive

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[Karas @OxKaras]

@icreatelife wow

[Karas @OxKaras]

@GenG lmao

[Karas @OxKaras]

https://t.co/qo5xYHyRR9

[Karas @OxKaras]

@kyleanthony Amazing

[Rarest @0xRarest]

me after turning $400 to $5000 then back ro $70

[Karas @OxKaras]

@Amank1412 cool

[Karas @OxKaras]

@tetsuoai 🔥🔥

[Karas @OxKaras]

@TzDev_ Design

[Karas @OxKaras]

@r0ktech Both 😄

[Karas @OxKaras]

@karthikponna19 hybrid 😆😆

[Karas @OxKaras]

@aashatwt 😆😆

[Karas @OxKaras]

@akramcodez https://t.co/njTFygQV34

[Karas @OxKaras]

@Xprofessorrr 🙃🙃

[Karas @OxKaras]

@GithubProjects https://t.co/njTFygQV34

[Karas @OxKaras]

@_devJNS lmao end :)))

[Karas @OxKaras]

@Palakonweb Cool

[Karas @OxKaras]

@mattiapomelli @figma sleek

[Karas @OxKaras]

@iyoushetwt hmm, I'm from frontend -> backend 😶😶

[Karas @OxKaras]

@Abhinavstwt 🤣🤣🤣