Map

TanStack

Wiki entityjavascripttypescriptreactopen-source ↳ show in map Markdown
title
TanStack
type
entity
summary
JS/TS library collective behind Query, Router, Table, Form, Virtual, Start — Tanner Linsley
tags
javascript, typescript, react, open-source
sources
tanstack-npm-supply-chain-postmortem
created
2026-05-12
updated
2026-05-12

JavaScript / TypeScript library collective founded by Tanner Linsley. Best known for TanStack Query (the canonical async-state library for React, now framework-agnostic), TanStack Router, TanStack Table, TanStack Form, TanStack Virtual, and the meta-framework TanStack Start. Published under the @tanstack/* npm scope; the GitHub org has roughly 295 packages across the active monorepos.

Maintained as a multi-maintainer scope (seven listed npm maintainers as of the 2026-05 incident) with publishing automated through GitHub Actions and npm Trusted Publishing.

Tracked here primarily as the subject of the May 2026 supply chain compromise — see that page for the detailed chain (pwn-request → cache poisoning → OIDC token extraction) and the defense lessons.

Notable events

  • 2026-05-11 — 84 malicious versions across 42 @tanstack/* packages published via a CI chain compromise. ~20-minute detection window via external researchers. Detailed in tanstack-npm-supply-chain-postmortem.

See also

Linked from