PostCSS maintainer Andrey Sitnik adopted npm staged publishing for four of seven packages under the 'ai' npm account, gating 685 million weekly downloads behind human approval. The move, prompted by a…
TanStack won two 2026 Open Source Awards at JSNation in Amsterdam: TanStack Start won Breakthrough of the Year and TanStack AI won AI Project of the Year. The awards highlight the open-source communit…
Docker Security Dispatch Issue 3 reports on major supply chain incidents including the TanStack and Nx Console compromise, the persistence of the Mini Shai-Hulud npm worm, and a kernel-level container…
TanStack AI reached Beta on June 9, 2026, introducing Code Mode, middleware, and host-side MCP. Code Mode lets the model write and execute TypeScript programs in a sandbox, reducing round trips, while…
OpenAI will revoke code-signing certificates for ChatGPT Desktop, Codex App, Codex CLI, and Atlas on June 26, 2026, after a supply chain attack via the Mini Shai-Hulud worm compromised employee device…
A developer detailed three vulnerabilities in the AI-coding-agent stack, including a supply chain worm that persists in developer toolchain configs, an abuse of shell built-ins to bypass Cursor's comm…
A developer studying AI and big data warns that AI is increasing cyber vulnerability in two ways: attackers using AI for more sophisticated attacks, and vulnerabilities introduced by integrating AI in…
TanStack released the Beta of TanStack AI, a framework-agnostic and provider-agnostic AI toolkit, on June 9, 2026. The update delivers stable core APIs, documented protocols, and first-class support f…
TanStack released experimental AI Workflows and Orchestrators on May 28, 2026, enabling developers to compose multi-step LLM and agent processes as TypeScript async generators with streaming, human-in…
In 2026, the combination of supply chain attacks and stale credentials is especially dangerous because attackers exploit trusted, unrotated tokens to gain long-term access to critical systems, bypassi…
TanStack's AI SDK now preserves structured output across chat turns by attaching typed data to each message, eliminating the need for manual state management. The update adds a `structured-output` par…
On May 11, 2024, TanStack suffered a sophisticated supply-chain attack that compromised 42 npm packages and published 84 malicious versions within six minutes. The attackers exploited GitHub Actions c…
TanStack AI has achieved full compliance with the AG-UI open protocol for agent-to-frontend communication, enabling bidirectional interoperability between any AG-UI client and server. The update makes…
A developer has released an open-source supply-chain audit script, "Mini Shai-Hulud," designed to detect the TanStack Router and Mistral AI supply-chain attacks. The bash script checks for specific SH…
TanStack issued an all-clear on May 15, 2026, after a three-day security sweep following the compromise of 42 Router/Start packages on npm. The malicious code was injected through a poisoned CI cache,…
On May 11, 2026, a coordinated supply chain attack compromised over 170 npm packages and 2 PyPI packages, totaling 404 malicious versions, targeting major projects including the entire TanStack router…
On May 11, 2026, an attacker compromised the TanStack Router/Start repository and published 84 malicious npm package versions across 42 packages by exploiting a pull_request_target vulnerability, GitH…