Skip to main content
When a broad ecosystem supply-chain incident makes the news — a poisoned npm package, a compromised container image, a backdoored build tool — Para investigates whether the event affects our systems or the SDKs we ship. This page records each notable event we assess, where we are in the investigation, and whether there was any impact. This page covers third-party and supply-chain events in the wider ecosystem. For the live availability of Para-hosted services, see .

​
How to read an advisory

Each advisory carries one of the following statuses:

​
Advisories

​
May 2026
Status: Resolved — No ImpactSummary: On May 11, 2026, an attacker published 84 malicious versions across 42 @tanstack/* npm packages. The compromise was part of the self-propagating “Mini Shai-Hulud” worm that affected 160+ npm and PyPI packages across multiple organizations, and was carried out via GitHub Actions cache poisoning and theft of an OIDC publishing token rather than stolen npm credentials. See the for the full technical write-up.Para’s assessment: Para’s Web SDK depends on several @tanstack/* packages, so we reviewed our exposure immediately. Para pins exact resolved dependency versions in committed lockfiles, and none of the compromised versions were ever resolved or installed in our builds or CI. No Para systems, build artifacts, or published SDK releases were affected.Customer action: None required to continue using Para. If you install @tanstack/* packages directly in your own application, we recommend auditing your lockfiles against the affected versions listed in the postmortem.
Para updates this page as new ecosystem events are assessed. To report a suspected security issue or ask about a specific advisory or CVE, contact .