unexpected ci failures prior to supply chain attack

TanStack Devtools version

v0.11.2

Framework/Library version

react v19.2.5

Describe the bug and the steps to reproduce it

We use some tanstack components but believe that our versions were locked to versions prior the compromised versions.

Having said that, while doing some research I noticed that our ci tests had been failing since 2026-05-06 07:30:00 UTC because of a missing @tanstack/devtools-vite package.

The successful run immediately prior to that was at 2026-05-06 07:04:00 UTC.

I assumed that our test failures we caused by a response to attack reported on 2026-05-11 but the fact that they predated by 5 days may be relevant to your compromise analysis iff the missing package is a side-effect of the malicious actors prior actions. If the malicious actor was responsible for the missing package, then these two timestamps might be useful to review.

  static              | 127.0.0.1 - - [06/May/2026:07:30:38 +0000] "GET /atlas/ HTTP/1.1" 200 1898 "-" "curl/8.14.1" "-"
  cx                  |    ╭─[ vite.config.ts:2:26 ]
  static              | 127.0.0.1 - - [06/May/2026:07:30:43 +0000] "GET /atlas/ HTTP/1.1" 200 1898 "-" "curl/8.14.1" "-"
  cx                  |    │
  cx                  |  2 │ import *** devtools *** from "@tanstack/devtools-vite";
  cx                  |    │                          ────────────┬────────────  
  cx                  |    │                                      ╰────────────── Module not found, treating it as an external dependency
  cx                  | ───╯
  cx                  | 
  cx                  | vite.config.ts (4:31) [UNRESOLVED_IMPORT] Warning: Could not resolve '@tanstack/router-plugin/vite' in vite.config.ts
  cx                  |    ╭─[ vite.config.ts:4:32 ]
  cx                  |    │
  mail                | time="2026/05/06 17:29:47" level=debug msg="[db] applied schema: 1.23.0.sql"

Your Minimal, Reproducible Example - (Sandbox Highly Recommended)

The issue is not reproducible - the packages are now being resolved. What I am reporting is that the packages were previously missing from the npm repo in the days preceding the supply chain attack. This might be relevant if you cannot otherwise explain why the packages were missing from the npm repo in that time frame.

The module not found error no longer occurs presumably because all the packages were rebuilt and republished from a clean source.

Screenshots or Videos (Optional)

No response

Do you intend to try to help solve this bug with your own PR?

None

Terms & Code of Conduct

• I agree to follow this project's Code of Conduct
• I understand that if my bug cannot be reliable reproduced in a debuggable environment, it will probably not be fixed and this issue may even be closed.

Bắt đầu với vite.config.ts và các log CI vào khoảng 2026-05-06 07:30 UTC, sau đó xem xét các lỗi phân giải package đã được báo cáo và lịch sử package của @tanstack/devtools-vite và @tanstack/router-plugin/vite. Hiện không có bản tái hiện hay test được đặt tên; hoàn tất có nghĩa là xác định liệu các package bị thiếu có liên quan đến sự cố supply-chain xảy ra sau đó hay chỉ là một vấn đề registry tạm thời không liên quan.