Start

TanStack issued an all-clear on May 15, 2026, after a three-day security sweep following the compromise of 42 Router/Start packages on npm. The malicious code was injected through a poisoned CI cache,…

On May 11, 2026, an attacker compromised the TanStack Router/Start repository and published 84 malicious npm package versions across 42 packages by exploiting a pull_request_target vulnerability, GitH…