The hook
Supply-chain malware is different from a normal dependency bug: the dangerous action can happen during installation, before the application ever starts. For @tanstack/arktype-adapter, the repo evidence that matters most is whether a project resolves to one of the malicious published versions.
How it works
The repo check looks for the npm package `@tanstack/arktype-adapter` in package manifests and lockfiles. Exact manifest declarations and lockfile-resolved versions are reported when they match 1.166.12 or 1.166.15, the affected versions listed by the TanStack and GitHub advisories.
The blast radius
If either malicious version was installed in a developer workstation or CI environment, credentials available to that install process should be treated as potentially exposed. A repo match should trigger package cleanup, cache/image rebuilds, and credential-impact review, but it is not proof that FixVibe observed exfiltration or host compromise.
// what fixvibe checks
What FixVibe checks
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Upgrade @tanstack/arktype-adapter to 1.166.16 or a newer clean release, or remove it if unused. Regenerate the active lockfile from a trusted registry state, rebuild CI images, Docker layers, devcontainers, and dependency caches, then rotate install-time credentials if either malicious version was ever installed.