About this episode

Kate Holterhoff interviews Jack Herrington about the TanStack npm supply-chain compromise and its implications for security in development.

Kate Holterhoff sits down with Jack Herrington, Principal Software Engineer at Netlify and maintainer of TanStack AI, to walk the May 2026 TanStack npm supply-chain compromise. They discuss the incident in depth, including the risk of chained attacks, the role of GitHub Actions, what we know about the hackers and mini shai-hulud. Jack also weighs in on why developers are becoming more security aware and why the supply chain and CI/CD is more important than ever in the AI era. Show notes: https://redmonk.com/videos/jack-herrington/ Chapters: 00:00 Introduction and Background 09:08 The TanStack Hack Incident 19:26 Security Insights and Lessons Learned 26:45 Evolving Cybersecurity Threats 34:22 Understanding Vulnerabilities in Open Source 40:47 AI in Development and Security Concerns 49:50 Advice for Open Source Maintainers

People in this episode

Host: Kate Holterhoff

Guest: Jack Herrington

Topics covered

• supply chain security
• cybersecurity threats
• open source vulnerabilities
• AI in development
• developer security awareness

Keywords

• TanStack
• npm
• supply chain
• cybersecurity
• open source
• AI
• GitHub Actions
• security awareness

Mentioned in this episode

Organizations: Netlify, TanStack

More episodes of The MonkCast

• Chris DeMars on Patching and Security in the AI Era · June 30, 2026 · 43 min
• An Interview with Kyle Daigle at Microsoft BUILD 2026: Models, Tokens, Agents & Developer Calm · June 25, 2026 · 35 min
• Inside the Acquisition: VoidZero Joins Cloudflare with Evan You · June 16, 2026 · 1h 0m

Explore listener stats, chart rankings, contacts and more on the The MonkCast podcast page.