Supply Chain Attacks Bypassed Every Trust Signal We Built

When the May 2026 TanStack compromise produced validly-attested malicious packages, it exposed a gap between what provenance proves and what security requires.

A few years ago, at a payment processing company where I was leading engineering, we walked a compliance auditor through our dependency security posture. Lockfiles enforced across all pipelines. Two-factor authentication on every npm publisher account. Provenance attestations enabled and verified on publish. The auditor said we had the strongest supply chain controls he’d seen at a fintech that size. I left that room thinking we’d gotten that one right.

Last week I read the TanStack postmortem.

On May 11, 2026, attackers compromised 84 package versions across the TanStack npm namespace, including libraries that handle routing and querying for millions of React applications. The @tanstack/react-router package alone had over 12 million weekly downloads. The attack was part of a broader campaign that eventually touched 160-plus npm package versions, including Mistral AI tooling and the Bitwarden CLI. All of it was part of something researchers named Shai-Hulud, the fifth wave in eight months.

What made this one different was what the malicious packages carried: valid SLSA Build Level 3 provenance attestations, signed…