On May 27, 2026, multiple critical supply chain vulnerabilities were disclosed affecting popular packages across npm, PyPI, Composer, Cargo, Maven, and GitHub Actions ecosystems. The FUXA package is vulnerable to unauthenticated remote code execution via path manipulation and script test mode authorization bypass. Several widely used packages including Laravel Lang, durabletask, AntV, node-ipc, TanStack, and lightning have been compromised through malicious republishing or maintainer account compromises, risking credential theft and arbitrary code execution. Additional high-severity issues include authorization bypasses and deserialization vulnerabilities in other packages. Immediate remediation involves upgrading affected packages or auditing and uninstalling compromised ones as recommended. These vulnerabilities underscore ongoing risks in software supply chains and the critical importance of dependency management.
The npm package 'tanstack' versions 2.0.4 through 2.0.7 contain malicious code. Installation or execution of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different, uncompromised machine is strongly recommended.