00:00PUBLISH
tanstack/react-virtual@3.10.7 ok
00:00INSTALL
+dependency.added chalk-extra 0.0.1
00:00PUBLISH
tanstack/react-virtual@3.10.8 publish
00:00ALERT
▸ typo: chalk-extras (ed=1) install spikes 240×
00:00INSTALL
▸ co-maintainer: vit-dev-bot 12 ops/min
00:00LOCKFILE
▸ 17 lockfile rows × 14 services
00:00GUARD
▸ breach window 4h 12m guard ⚑
step 109:00
tanstack/react-virtual@3.10.8 published clean
CVE stream shows zero advisories. The PR diff is small. The version bumps from 3.10.7.
step 209:02
3.10.8 republished with payload
A benign dependency is added; the new build embeds a token-stealer that runs in .claude/. The npm audit stream does not flag it.
step 309:04
17 services in your stack route through it
One Cypher — MATCH (bad)<-[:DEPENDS_ON*1..6]-(svc:Service) — answers the page's headline question. Meridian renders the six tiles in <350 ms.