May 2026: attackers forge valid provenance for 42 TanStack packages on npm, with 84 malicious versions shipped before detection. August 2026: a worm uses one maintainer's stolen credentials to self-propagate through keyv and its dependent packages.
May 2026: attackers forge valid provenance for 42 TanStack packages on npm, with 84 malicious versions shipped before detection.
August 2026: a worm uses one maintainer's stolen credentials to self-propagate through keyv and its dependent packages.
March 2026: malicious versions of axios get published directly to npm.
The page is ready to read now. The fuller skim-friendly version will appear here automatically.
May 2026: attackers forge valid provenance for 42 TanStack packages on npm, with 84 malicious versions shipped before detection. August 2026: a worm uses one maintainer's stolen credentials to self-propagate through keyv and its dependent packages. March 2026: malicious versions of axios get published directly to npm.
Open the app view to save this story, compare related coverage, and continue from the same source.