What now? explaining the TanStack Supply Chain Attack

If you install any tanstack package you might be affected. That it, on May 11, 2026, one of the most sophisticated npm supply chain attacks ever seen hit the JavaScript ecosystem , and it's still spreading. This is my attempt to explain it simply, because the technical details are buried in postmortems and most developers I know haven't fully digested what this means for them. What happened The attackers compromised 42 TanStack packages , publishing 84 malicious versions in a 6-minute window. Ta