supply chain / tanstack-react-start

TanStack React Start

registrynpm
package name@tanstack/react-start
maintainerTanStack

TanStack React Start is the full-stack React meta-framework built on TanStack Router and Nitro, providing server-side rendering, server functions, and API routes. It is the JavaScript counterpart to frameworks like Next.js and Remix, targeted at React applications that require collocated server and client code.

api usage

Checking TanStack React Start

@tanstack/react-start 1.56.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.

bash
curl "https://api.attestd.io/v1/check?product=%40tanstack%2Freact-start&version=1.56.0" \
  -H "Authorization: Bearer YOUR_API_KEY"
example response
json
{
  "product": "@tanstack/react-start",
  "version": "1.56.0",
  "supported": true,
  "risk_state": "none",
  "risk_factors": [],
  "actively_exploited": false,
  "remote_exploitable": false,
  "authentication_required": false,
  "patch_available": false,
  "fixed_version": null,
  "confidence": 0.9,
  "cve_ids": [],
  "cves": null,
  "max_epss": null,
  "typosquat": null,
  "supply_chain_monitored": true,
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null
  },
  "last_updated": "2026-05-01T00:00:00Z"
}
attack surface

Why this package is monitored

TanStack React Start server functions run next to env vars, DB clients, and filesystem access. Compromise lets an attacker read server-function args that commonly include auth context and query parameters.

Attestd monitors @tanstack/react-start using the following detection sources:

registry

Manually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.

osv

OSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.

npm_deprecation

npm package versions with deprecation messages containing targeted attack language such as malicious, backdoor, or compromised. Confidence 0.80.

related