Real attacks on the Node.js dependency chain: what happened, whether you are affected, what to do now, and how each one worked, one step at a time. Every fact traces to a linked primary source.
A link to your own app's server-function endpoint could make your server answer with HTML an attacker chose, and run it as whoever clicked. Disclosed on 30 September 2026. This is how it worked, layer by layer, and what to do now.
A pull request that was never merged got TanStack's own release pipeline to publish malware, with valid provenance. This is the chain, one trust boundary at a time, and what to do if you installed it.
One unauthenticated HTTP request could run code on any server using React Server Components. This is how it worked, one layer at a time, and what to do about it.
Install an infected package and it stole your secrets, then used your own npm token to infect the packages you maintain. Every victim became the next publisher. This is the loop, both waves of it, and what to do if it ran on your machine.
One look-alike “update your 2FA” email handed an attacker a maintainer's npm account. Nineteen tiny packages under almost every JavaScript project shipped a payload that stayed quiet on servers and rewrote wallet addresses in users' browsers.
Next.js trusted an internal header on requests from the internet. Any client could add it, and self-hosted apps skipped their middleware, login checks included. This is how one request walked past the gate.