Mass Supply Chain Attack Hits TanStack, Mistral AI npm and PyPI Packages
safedep.io
Over 400 compromised npm package versions and at least 2 PyPI packages published in a coordinated supply chain attack targeting TanStack, Mistral AI, UiPath, OpenSearch, guardrails-ai, and dozens of other packages.

massive campaign for 170+ packages and 400+ malicious versions published. what we saw that not a single maintainer account compromised. tanStack and Mistral AI these are the names that stand out.

  • kibiz0r@midwest.socialEnglish
    25·
    2 days ago
    • Use lockfiles
    • Use minimum release age gating
    • Disable postinstall hooks
    • Limit credentials of CI jobs, especially ones that eagerly update deps
    • Disable dep-updating features completely (at the network level if you can) when deploying to higher envs
    • Be skeptical of standalone CLIs — they often try to self-update, or bootstrap deps from npm, and don’t always use lockfiles to manage it