# TanStack

JavaScript / TypeScript library collective founded by Tanner Linsley. Best known for **TanStack Query** (the canonical async-state library for React, now framework-agnostic), **TanStack Router**, **TanStack Table**, **TanStack Form**, **TanStack Virtual**, and the meta-framework **TanStack Start**. Published under the `@tanstack/*` npm scope; the GitHub org has roughly 295 packages across the active monorepos.

Maintained as a multi-maintainer scope (seven listed npm maintainers as of the 2026-05 incident) with publishing automated through GitHub Actions and npm Trusted Publishing.

Tracked here primarily as the subject of the [[tanstack-npm-supply-chain-postmortem|May 2026 supply chain compromise]] — see that page for the detailed chain (pwn-request → cache poisoning → OIDC token extraction) and the defense lessons.

## Notable events

- **2026-05-11** — 84 malicious versions across 42 `@tanstack/*` packages published via a CI chain compromise. ~20-minute detection window via external researchers. Detailed in [[tanstack-npm-supply-chain-postmortem]].

## See also

- [[supply-chain-security]] — the broader concept
- [[pwn-request-pattern]], [[github-actions-cache-poisoning]], [[ci-runner-token-extraction]] — the three chained vulnerabilities