Mass Supply Chain Attack Hits TanStack, Mistral AI npm and PyPI Packages
safedep.io
Over 400 compromised npm package versions and at least 2 PyPI packages published in a coordinated supply chain attack targeting TanStack, Mistral AI, UiPath, OpenSearch, guardrails-ai, and dozens of other packages.

massive campaign for 170+ packages and 400+ malicious versions published. what we saw that not a single maintainer account compromised. tanStack and Mistral AI these are the names that stand out.

  • brian@programming.dev
    4·
    4 days ago

    probably not, I haven’t seen any other post mortems but the tanstack ones were only up for 20 minutes so really low chance. I wouldn’t be surprised if they were all a similar approach and that’s why they all happened at the same time