Incident review for TanStack NPM supply chain ransom incident
TanStack suffered an NPM supply chain attack on February 13, 2025, when an attacker gained access to the @tanstack/eslint-plugin-query package. The attacker published malicious versions (1.0.0–1.0.4) containing ransomware that encrypted local files and demanded a ransom. Grafana Labs' post-incident review details the attack timeline, impact, and lessons for securing open-source supply chains.
Background
- **TanStack** is a popular open-source project that makes front-end web development tools (like React Query, TanStack Table). Its code is distributed via **npm**, the standard JavaScript package registry used by millions of websites.
- A **supply chain attack** (also called a "dependency confusion" or "package hijack") means an attacker gained control over the project's npm publishing credentials and pushed a malicious update. Anyone who automatically updated the library would have run that attacker's code on their servers or users' browsers.
- In this incident, the attacker altered TanStack packages to display a ransom note demanding payment, rather than silently stealing data. The attacker likely obtained the npm token through a phishing email, a password leak, or by compromising a maintainer's machine.
- The "post-incident review" format is a standard DevOps practice: after a security or outage event, the team writes a public, honest account of what went wrong, how it was fixed, and what changes will prevent a repeat. Grafana, the observability company, published this analysis because they use TanStack's tools and want to share lessons with the wider developer community.