unexpected ci failures prior to supply chain attack

TanStack Devtools version

v0.11.2

Framework/Library version

react v19.2.5

Describe the bug and the steps to reproduce it

We use some tanstack components but believe that our versions were locked to versions prior the compromised versions.

Having said that, while doing some research I noticed that our ci tests had been failing since 2026-05-06 07:30:00 UTC because of a missing @tanstack/devtools-vite package.

The successful run immediately prior to that was at 2026-05-06 07:04:00 UTC.

I assumed that our test failures we caused by a response to attack reported on 2026-05-11 but the fact that they predated by 5 days may be relevant to your compromise analysis iff the missing package is a side-effect of the malicious actors prior actions. If the malicious actor was responsible for the missing package, then these two timestamps might be useful to review.

  static              | 127.0.0.1 - - [06/May/2026:07:30:38 +0000] "GET /atlas/ HTTP/1.1" 200 1898 "-" "curl/8.14.1" "-"
  cx                  |    ╭─[ vite.config.ts:2:26 ]
  static              | 127.0.0.1 - - [06/May/2026:07:30:43 +0000] "GET /atlas/ HTTP/1.1" 200 1898 "-" "curl/8.14.1" "-"
  cx                  |    │
  cx                  |  2 │ import *** devtools *** from "@tanstack/devtools-vite";
  cx                  |    │                          ────────────┬────────────  
  cx                  |    │                                      ╰────────────── Module not found, treating it as an external dependency
  cx                  | ───╯
  cx                  | 
  cx                  | vite.config.ts (4:31) [UNRESOLVED_IMPORT] Warning: Could not resolve '@tanstack/router-plugin/vite' in vite.config.ts
  cx                  |    ╭─[ vite.config.ts:4:32 ]
  cx                  |    │
  mail                | time="2026/05/06 17:29:47" level=debug msg="[db] applied schema: 1.23.0.sql"

Your Minimal, Reproducible Example - (Sandbox Highly Recommended)

The issue is not reproducible - the packages are now being resolved. What I am reporting is that the packages were previously missing from the npm repo in the days preceding the supply chain attack. This might be relevant if you cannot otherwise explain why the packages were missing from the npm repo in that time frame.

The module not found error no longer occurs presumably because all the packages were rebuilt and republished from a clean source.

Screenshots or Videos (Optional)

No response

Do you intend to try to help solve this bug with your own PR?

None

Terms & Code of Conduct

• I agree to follow this project's Code of Conduct
• I understand that if my bug cannot be reliable reproduced in a debuggable environment, it will probably not be fixed and this issue may even be closed.

从 vite.config.ts 和 2026-05-06 07:30 UTC 前后的 CI 日志开始，然后查看报告中的 package 解析失败，以及 @tanstack/devtools-vite 和 @tanstack/router-plugin/vite 的 package 历史。目前没有可复现步骤，也没有命名的测试；完成的标准是确定缺失的 package 是否与之后的供应链事件有关，还是一个无关的临时 registry 问题。