Scan a package
home›scan›tanstack/react-virtual@3.10.8

tanstack/react-virtual exposure.

Below is the verdict plus every row that produced it. Click show cypher on any tile to inspect the query.

CRITverdict·tanstack/react-virtual@3.10.8just now
17 services exposed · 6 lockfiles resolved the bad version · 6 typosquats nearby.
fix:  pnpm update tanstack/react-virtual@^3.10.8   ▸  breach window 4h 12m
fix command
$ pnpm update tanstack/react-virtual@^3.10.8
share
https://meridian.sithunyein.com/scan/tanstack%2Freact-virtual%403.10.8
▸ open replay
enter ⏎
try

The six tiles

1ms · hydradb:https://cheap-dawn-noble-located.trycloudflare.com (fixture tiles)
CRIT

17 services exposed

17 rows · 45ms

MATCH (npm:tanstack/react-virtual@3.10.8)<-[:DEPENDS_ON*1..6]-(svc:Service)

serviceteamenvhops
checkout-svcplatformprod1
worker-queuecheckoutstage2
edge-routergrowthprod3
auth-api-gwbillingprod4
billing-svcedgeprod1
search-svcplatformprod2
notification-svccheckoutstage3
audit-loggergrowthprod4
tenant-routerbillingprod1
ci-runner-apiedgeprod2
feature-flags-svcplatformprod3
dlq-pullcheckoutstage4
geo-redirectorgrowthprod1
session-storebillingprod2
metrics-collectoredgeprod3
incident-room-botplatformprod4
tmpl-renderercheckoutstage1
shape · MATCH (n)<-[:DEPENDS_ON*1..3]-(svc) — 3-hop budget
HIGH

first bad version: 3.10.8

3 rows · 49ms

MATCH (advisory)-[:AFFECTS]->(version) — published timeline

versionpublishedrepolive_during_compromise
3.10.72026-07-12github.com/TanStack/virtualfalse
3.10.82026-08-14github.com/TanStack/virtualtrue
3.10.92026-08-15github.com/TanStack/virtualfalse
shape · MATCH (Advisory)-[:AFFECTS]->(Version {id:Int})
HIGH

6 lockfiles resolved this version

6 rows · 59ms

MATCH (Version)<-[:RESOLVES]-(Lockfile)<-[:USES_LOCKFILE]-(Service)

lockfileserviceteamcapturedwindow
apps/web/package-lock.jsoncheckout-svcplatform2026-08-11T00:00Z4h 12m
apps/mobile/package-lock.jsonworker-queuecheckout2026-08-12T01:00Z4h 12m
services/checkout/package-lock.jsonedge-routergrowth2026-08-13T02:00Z4h 12m
services/worker/package-lock.jsonauth-api-gwbilling2026-08-14T03:00Z4h 12m
services/edge/package-lock.jsonbilling-svcedge2026-08-15T04:00Z4h 12m
packages/ui-tw/package-lock.jsonsearch-svcplatform2026-08-16T05:00Z4h 12m
shape · MATCH (Lockfile)-[:RESOLVES]->(Version {id:Int})
INFO

5 packages share a maintainer

5 rows · 45ms

MATCH (Maintainer)-[:MAINTAINS]->(sibling) — same-CI clusters collapse

packageecosystemmonthly_downloadssame_ci
tanstack/react-querynpm240000true
tanstack/react-tablepypi223000false
tanstack/react-routernpm206000false
tanstack/query-corepypi189000false
tanstack/virtual-corenpm172000false
shape · MATCH (pkg)<-[:MAINTAINED_BY]-(m)-[:MAINTAINED_BY]->(sib)
HIGH

6 typosquat candidates within edit-distance 2

6 rows · 53ms

MATCH (Package)<-[:TYPOSQUAT_OF { distance: 1..2 }]-(candidate)

candidateedit_distancefirst_seeninstalls
tanstack/react-virtual112026-08-10T00:00Z1280
tanstack/reactvirt22026-08-11T01:00Z1170
tanstack/react-virtualx12026-08-12T02:00Z1060
react-virtual-tanstack22026-08-13T03:00Z950
tanstack/react-virtual-old12026-08-14T04:00Z840
@tanstack/react-virtual22026-08-15T05:00Z730
shape · MATCH (p)<-[:TYPOSQUAT_OF]-(t)
CRIT

blast radius: 17 services · 6 lockfiles · 6 typosquats

1 rows · 42ms

AGG services ⊕ lockfiles ⊕ typosquats — 3 optional MATCH arms in one query

services_countlockfiles_counttyposquats_count
1766
shape · count(svc) from Package fan-in
00:00PUBLISHtanstack/react-virtual

tanstack/react-virtual@3.10.8 published clean

60:00INSTALL

+dependency.added chalk-extra 0.0.1

120:00PUBLISHtanstack/react-virtual

tanstack/react-virtual@3.10.8 rebuilt with payload

180:00ALERT

typosquat install spike 240× chalk-extras

240:00INSTALL

co-maintainer vit-dev-bot 12 ops/min

300:00LOCKFILE

6 lockfiles × 17 services resolved the bad version

360:00GUARD

breach window 4h 12m push guard ⚑