TanStack Query code generator is compromised by a supply chain

The security of our dependency tree just took another hit, and this time it's targeting the developer experience layer. A malicious worm has been identified within a widely used code generator for TanStack Query. This isn't just some low-effort script kiddie attempt; we are looking at a sophisticated supply chain attack that specifically targets the automated workflows many of us rely on to keep our data-fetching logic clean and type-safe.

If you use automated tools to scaffold your React hooks or generate API client code based on your schema, you need to audit your local environment immediately.

What actually happened

The attacker managed to inject malicious code into the package distribution, essentially turning a tool meant for productivity into a vector for infection. Unlike a simple data exfiltration attempt, this worm behaves more like a traditional Trojan. Once the compromised version of the generator is pulled into a project via npm or yarn, the payload executes during the installation or build phase.

The primary goal appears to be environment reconnaissance. The script attempts to scan for local .env files, SSH keys, and cloud provider credentials (like AWS or GCP config files) stored in the user's home directory. It then attempts to exfiltrate this sensitive data to a remote command-and-control server.

How to handle the cleanup

If you suspect you have pulled the compromised version, do not just run npm install again. That won't fix the underlying issue if the malicious files have already touched your filesystem or if your environment variables are already compromised.

1. Identify the version: Check your package-lock.json or yarn.lock immediately. Look for any recent updates to TanStack-related generator tools that occurred within the last 48-72 hours.
2. Nuke the node_modules: Don't just delete the folder; clear your local npm cache as well.

   rm -rf node_modules package-lock.json
   npm cache clean --force

3. Rotate your secrets: This is the most critical step. If the worm ran, assume every secret in your .env files, your GitHub tokens, and your AWS keys is compromised. Start rotating them from the most sensitive down to the least.
4. Audit your CI/CD: Check your build logs for any unusual outbound network requests during the installation phase.

Why this is a problem for prompt engineering and AI workflows

This attack highlights a massive blind spot in modern AI-driven development. As we move toward more autonomous AI workflows—where LLM agents are writing code, running terminal commands, and managing deployments—the risk of a "poisoned" dependency grows exponentially.

If an AI agent is tasked with "upgrading all project dependencies to the latest version" or "implementing a new data-fetching layer using TanStack Query," it might inadvertently pull in this worm without a human ever seeing the version bump in a PR. We are essentially building high-speed highways for malware by giving AI agents unvetted access to our package managers.

We need to move toward a more rigorous, sandboxed approach for any tool that has the permission to execute code during the installation phase. Relying on "blind trust" in the npm ecosystem is no longer a viable strategy for professional software engineering.