fabriziosalmi/TanStack Compromise Checker
Detect indicators of the TanStack npm supply chain attack (CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx) in a repository.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| scan-dir | Directory to scan (relative to repository root). Defaults to the entire workspace. | no | . |
| online | Enable online verification (advisory fetch + npm registry publish-time check). Set to "true" to enable. | no | false |
| fail-on | Severity that triggers a non-zero exit: "fail" (default), "warn" (fail also on warnings), or "never". | no | fail |
| json-output | Path (relative to workspace) to write the findings JSON. Empty = no JSON file. | no | tanstack-compromise-findings.json |
| bad-versions-file | Optional path to a sibling file listing additional pkg@version entries. | no | "" |
| ghsa-id | Override the GHSA ID used in --online advisory fetch. | no | GHSA-g7cv-rxg3-hmpx |
Outputs
| name | description |
|---|---|
| passed | Number of checks that passed. |
| warnings | Number of warnings raised. |
| failed | Number of failures raised. |
| exit-code | Raw exit code of check.sh (0 clean, 1 warn, 2 fail, 3 tool error). |
| findings-path | Path to the JSON findings file (if json-output was set). |