Mass Supply Chain Attack Hits TanStack, Mistral AI npm and PyPI Packages
safedep.io
Over 400 compromised npm package versions and at least 2 PyPI packages published in a coordinated supply chain attack targeting TanStack, Mistral AI, UiPath, OpenSearch, guardrails-ai, and dozens of other packages.

massive campaign for 170+ packages and 400+ malicious versions published. what we saw that not a single maintainer account compromised. tanStack and Mistral AI these are the names that stand out.

  • HaraldvonBlauzahn@feddit.org
    1·
    3 days ago

    Still, npm itself isn’t inherently unsafe

    The bucket stops at that it isn’t safe. Which is partially a cultural problem. And npm users worked hard to get to that place - it’s not the case that them were not given warnings.