Supply chain attacks

An In-Depth Analysis of the TanStack Supply Chain Attack: A Security Wake-Up Call for the Open-Source Ecosystem and Strategies for Web3 Protection

In May 2026, TanStack suffered a sophisticated supply chain attack that affected more than 160 npm and PyPI packages, including those from Mistral AI, UiPath, and OpenAI. The attackers exploited a chain of three vulnerabilities in GitHub Actions to publish malicious packages with valid signatures without stealing any credentials. This incident revealed deep-seated risks in the open-source software supply chain—including CI/CD pipelines, caches, and workflow permissions—and served as a wake-up call for Web3 projects, underscoring the importance of strengthening development process security, dependency management, and user protection to prevent credential theft and asset loss.