unexpected ci failures prior to supply chain attack

[jonseymour]

TanStack Devtools version

v0.11.2

Framework/Library version

react v19.2.5

Describe the bug and the steps to reproduce it

We use some tanstack components but believe that our versions were locked to versions prior the compromised versions.

Having said that, while doing some research I noticed that our ci tests had been failing since 2026-05-06 07:30:00 UTC because of a missing @tanstack/devtools-vite package.

The successful run immediately prior to that was at 2026-05-06 07:04:00 UTC.

I assumed that our test failures we caused by a response to attack reported on 2026-05-11 but the fact that they predated by 5 days may be relevant to your compromise analysis iff the missing package is a side-effect of the malicious actors prior actions. If the malicious actor was responsible for the missing package, then these two timestamps might be useful to review.

  static              | 127.0.0.1 - - [06/May/2026:07:30:38 +0000] "GET /atlas/ HTTP/1.1" 200 1898 "-" "curl/8.14.1" "-"
  cx                  |    ╭─[ vite.config.ts:2:26 ]
  static              | 127.0.0.1 - - [06/May/2026:07:30:43 +0000] "GET /atlas/ HTTP/1.1" 200 1898 "-" "curl/8.14.1" "-"
  cx                  |    │
  cx                  |  2 │ import *** devtools *** from "@tanstack/devtools-vite";
  cx                  |    │                          ────────────┬────────────  
  cx                  |    │                                      ╰────────────── Module not found, treating it as an external dependency
  cx                  | ───╯
  cx                  | 
  cx                  | vite.config.ts (4:31) [UNRESOLVED_IMPORT] Warning: Could not resolve '@tanstack/router-plugin/vite' in vite.config.ts
  cx                  |    ╭─[ vite.config.ts:4:32 ]
  cx                  |    │
  mail                | time="2026/05/06 17:29:47" level=debug msg="[db] applied schema: 1.23.0.sql"

Your Minimal, Reproducible Example - (Sandbox Highly Recommended)

The issue is not reproducible - the packages are now being resolved. What I am reporting is that the packages were previously missing from the npm repo in the days preceding the supply chain attack. This might be relevant if you cannot otherwise explain why the packages were missing from the npm repo in that time frame.

The module not found error no longer occurs presumably because all the packages were rebuilt and republished from a clean source.

Screenshots or Videos (Optional)

No response

Do you intend to try to help solve this bug with your own PR?

None

Terms & Code of Conduct

• I agree to follow this project's Code of Conduct
• I understand that if my bug cannot be reliable reproduced in a debuggable environment, it will probably not be fixed and this issue may even be closed.

[github-actions]

Thanks for the report and for including the timeline details. To make this actionable, could you please update the Minimal, Reproducible Example section with a runnable reproduction link (CodeSandbox/StackBlitz/repo) that demonstrates the @tanstack/devtools-vite resolution failure?

Right now that required field says "Please read text, reclassify as necessary", which doesn’t provide a debuggable repro. A minimal repro plus exact install/lockfile context will help us verify whether this is a package-availability issue versus project-specific CI setup.