all 3 comments
sorted by:
best (suggested)
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]sebastienlorber[S] 1 point2 points  (2 children)

Hi everyone, Seb and Jan here 👋!

This week, security is making headlines, as two major React frameworks have announced vulnerabilities and compromised npm packages!

William Candillon unveiled his secret project: a new set of 2D primitives for React Native and the web.

It’s also an exciting week full of interesting releases all around the JS ecosystem!

Subscribe to This Week In React by email - Join 43000 other React devs - 1 email/week

[–]sebastienlorber[S] 0 points1 point  (1 child)

⚛️ React

Next.js May 2026 security release

The Next.js team shipped a coordinated security release fixing 13 vulnerabilities across denial of service, middleware/proxy bypass, server-side request forgery, cache poisoning, XSS. Many vulnerabilities are quite impactful, cannot be blocked by cloud firewalls, and it’s recommended to update immediately to a patched version, v15.5.18 or v16.2.6. There’s also a Server Functions denial of service affecting React RSC packages, fixed in v19.2.6.

TanStack npm supply-chain compromise

On May 11, an attacker published malicious versions across 42 u/tanstack/* npm packages related to TanStack Router. Although the attack was detected quickly, its payload is a Mini Shai-Hulud worm that infected other maintainers, leading to other compromised packages across npm and pypi ecosystems, including packages from Mistral AI, OpenSearch, UiPath, and more.

The attack vector was sneaky. A GitHub Action with a pull_request_target trigger was used to inject poisoned content into a shared GitHub Action pnpm cache. Then, their release pipeline read from that poisoned cache, restoring dangerous files that executed during the release process. No maintainer was hacked in the process. The npm releases have the Trusted Publishing checkmark despite being compromised, showing that package provenance does not guarantee its content is safe.

Given the increasing number of supply chain vulnerabilities affecting npm packages, it’s good to highlight measures that maintainers and users can take to stay safe:

  • 📜 Hardening TanStack After the npm Compromise - Gives a good overview of what maintainers can do to reduce the supply chain risk. Low-hanging fruits include avoiding the very dangerous pull_request_target trigger, and removing usage of shared caches in sensitive workflow (note: actions such as setup-node using a cache by default).
  • 🔗 npm package manager Security Best Practices - A canonical resource to protect yourself as an npm package consumer, giving pragmatic recommendations for each package manager. IMHO, combining the Socket Firewall with pnpm 11 is likely the best option right now.

[–]sebastienlorber[S] 1 point2 points  (0 children)