Postmortem: TanStack NPM supply-chain compromise

[dead]

[flagged]

[flagged]

[dead]

[dead]

So when do we call out NPM as an easy supply chain vector and also Microsoft's ownership of NPM and their prioritisation of AI at any cost.

NPM is the windows of package managers right now.

TanStack? Jia Tan? Who is falling for this???

The nogil work has been years in the making. Curious how this impacts existing C extensions that relied on GIL guarantees.

I've got claude to throw this together to try an help stem the flow. Obviously verify yourself but it will scan your machine to try and find any of the mentioned compromised packages: https://github.com/PaulSinghDev/tanstack-shai-hulud-fix