Reported by 2 outlets
Hackers Compromise TanStack Query npm Package to Steal Developer Credentials
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.54 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Hackers Compromise TanStack Query npm Package to Steal Developer Credentials
gbhackers.com · 45d ago · August 29th, 2026
A supply-chain worm has compromised multiple releases of @7nohe/openapi-react-query-codegen, an npm package that generates type-safe TanStack Query hooks. Aikido Security said it identified 10 malicious versions published within 20 minutes. Because the package records more than 150,000 weekly downloads, the incident poses exposure risk to development teams. The breach exposes developer workstations and CI systems […] The post Hackers Compromise TanStack Query npm Package to Steal Developer Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Supply Chain Worm Hits Popular TanStack Query Code Generator to Steal Developer Credentials
cyberpress.org · 45d ago · August 29th, 2026
The package records more than 150,000 weekly downloads, making the incident consequential for developers installing JavaScript dependencies. The payload identifies itself as “Trinitite: Sponsored by Preview 2 Effects,” and researchers said its tradecraft resembles TeamPCP-linked activity, although attribution remains unresolved. Supply Chain Worm Hits Popular TanStack Query Code Generator The compromise reportedly affected both the npm package and its GitHub repository. Attackers are believed to have abused a weakness in a GitHub Actions workflow , meaning releases retained valid provenance attestations. That detail is significant: attestations confirm that a release originated from an authorized workflow, but cannot establish safety when the workflow itself has been altered or compromised. Most affected versions weaponized binding.gyp, a Node.js native-addon build configuration file. During installation, node-gyp evaluates its conditions using Python. The malicious file abuses Python’s class hierarchy to locate catch_warnings, regain access to built-in functions, import the os module, and run an obfuscated Node.js payload. No legitimate nat