Skip to content
Vurqel®
Prove which build actually resolved a compromised package while it was live.

Live, interactive replay of the verified case — break a link and watch the verdict change.
Investigate the case →Read the receipt
01 / Introduction

A dependency list is not a blast radius.

In May 2026 the TanStack npm packages were compromised for a few hours. Every responder asked the same thing: did any of our builds actually install the bad version, or is it just a name in a lockfile? A scanner flags the mention. Vurqel proves the resolution.

Incident window (UTC)
[2026-05-11T19:26:14Z, 22:13:38Z)
Package
@tanstack/react-router@1.169.8
Retrieved
2026-08-18
02 / Manifesto

Three verdicts. Never a guess.

EXPOSED

A complete, same-SHA path runs from the incident to a production-labelled build.

NOT_EXPOSED

The evidence is complete and no such path exists. Absence, proven.

UNPROVEN

The evidence is missing, ambiguous, or contradictory. Vurqel refuses to conclude.

It proves build provenance. It does not prove malware execution, credential theft, or end-user traffic. Every conclusion links to a public artifact, so anyone can check it.

03 / MechanismIncident → Service · 7 hops

The chain only holds on one SHA.

  1. 01AFFECTS

    The incident names the exact affected package and version.

    same package @ version
  2. 02RESOLVED_BY

    A lockfile snapshot resolves that exact version.

    lockfile entry alone is not proof
  3. 03AT_COMMIT

    The lockfile sits at an immutable commit inside the live window.

    same-SHA join · half-open [from, to)
  4. 04TRIGGERS

    A workflow run exists on that same commit.

    run head SHA = commit SHA
  5. 05HAS_JOB

    A frozen-lockfile install and a successful named job on that SHA.

    the named job decides, not the run
  6. 06PRODUCES

    A same-SHA service build succeeded.

    check-run success on the SHA
  7. 07TARGETS

    That build is production-labelled.

    environment = production
04 / Graph-native

Built on HydraDB.

The proof is a graph path, not a boolean. Vurqel writes typed nodes and edges through HydraDB, then reads the receipt from one bounded, snapshot-consistent traversal. An edge exists only when its hop was verified, so a complete Incident to Service path comes back only when the result is EXPOSED.

A vector store cannot answer this. The question is exact same-SHA path completeness on one snapshot, not similarity.

CALL algo.SPpaths({
  sourceNode: <incident>, targetNode: <service>,
  relTypes: ['AFFECTS','RESOLVED_BY','AT_COMMIT','TRIGGERS',
             'HAS_JOB','PRODUCES','TARGETS'],
  maxLen: 8, relDirection: 'outgoing', pathCount: 1
}) YIELD path RETURN path   // consistency: strong
Returns · verified caseEXPOSED

path · 8 nodes / 7 edges · complete

Incident → PackageVersion → LockfileSnapshot → GitCommit → WorkflowRun → CIJob → ServiceBuild → Service

snapshot sgk:1:…:15 · every node on SHA 939d3bd1

Returns · one broken SHAUNPROVEN

path · null · only 4 of 7 edges written

The HAS_JOB hop fails the same-SHA join, so that edge is never written and no complete path exists. The graph will not return a path it cannot verify.

reason UNPROVEN_SHA_MISMATCH

Real HydraDB output, reproducible in the repo under proof/ ↗

05 / Investigate

Break the chain.

Conditions

  • Named job on the same commit SHA

    Break it → SHA mismatch → UNPROVEN

  • Frozen-lockfile install in CI

    Break it → a lockfile entry alone is not proof → UNPROVEN

  • Named job succeeded

    Break it → the build did not succeed → NOT_EXPOSED

  • Production-labelled service build

    Break it → not production → NOT_EXPOSED

Verdict

EXPOSED

EXPOSED_SAME_SHA_PATH

A complete same-SHA provenance path proves this build resolved the affected package during its live window.

  1. →AFFECTSverified
  2. →RESOLVED_BYverified
  3. →AT_COMMITverified
  4. →TRIGGERSverified
  5. →HAS_JOBverified
  6. →PRODUCESverified
  7. →TARGETSverified
06 / Proof

The verified case, on the record.

Incident window (UTC)
[2026-05-11T19:26:14Z, 22:13:38Z) ↗
Affected package
@tanstack/react-router@1.169.8
Commit
939d3bd1b05ee09f0f4c2585a492f98da0fd066d ↗
Lockfile (sha256)
04916898507a414af7e59f9083ade5f604a0358ae676ad216e50d0f605330f6d ↗
Workflow run (overall failure)
25698962181 ↗
Named job
Build (tools) = success
Service build (production)
Workers Builds: websites-tools = success · 75454451577 ↗
Receiptvq_5c59866f

EXPOSED

EXPOSED_SAME_SHA_PATH

Proves build provenance only: a compromised package was resolved in the incident window and a same-SHA production-labelled build succeeded. Does NOT prove malware execution, credential theft, or end-user traffic.

{
  "requestId": "vq_5c59866f",
  "ruleVersion": "vurqel-eligibility-v1",
  "state": "EXPOSED",
  "reasonCode": "EXPOSED_SAME_SHA_PATH",
  "reason": "A complete same-SHA provenance path proves this build resolved the affected package during its live window.",
  "package": {
    "ecosystem": "npm",
    "name": "@tanstack/react-router",
    "version": "1.169.8"
  },
  "interval": {
    "from": "2026-05-11T19:26:14Z",
    "to": "2026-05-11T22:13:38Z"
  },
  "repository": "RelativeSure/websites",
  "sources": [
    {
      "label": "incident",
      "url": "https://tanstack.com/blog/npm-supply-chain-compromise-postmortem"
    },
    {
      "label": "lockfile",
      "url": "https://github.com/RelativeSure/websites/blob/939d3bd1b05ee09f0f4c2585a492f98da0fd066d/tools/pnpm-lock.yaml"
    },
    {
      "label": "commit",
      "url": "https://github.com/RelativeSure/websites/commit/939d3bd1b05ee09f0f4c2585a492f98da0fd066d"
    },
    {
      "label": "workflow",
      "url": "https://github.com/RelativeSure/websites/blob/939d3bd1b05ee09f0f4c2585a492f98da0fd066d/.github/workflows/ci.yml"
    },
    {
      "label": "workflow-run",
      "url": "https://github.com/RelativeSure/websites/actions/runs/25698962181"
    },
    {
      "label": "ci-job",
      "url": "https://github.com/RelativeSure/websites/actions/runs/25698962181/job/75454350988"
    },
    {
      "label": "service-build",
      "url": "https://github.com/RelativeSure/websites/runs/75454451577"
    }
  ],
  "generatedAt": "2026-08-18T15:11:14.818Z",
  "limitations": [
    "Frozen-install proof is the immutable workflow definition plus the named job result; raw step logs are not used."
  ],
  "claimBoundary": "Proves build provenance only: a compromised package was resolved in the incident window and a same-SHA production-labelled build succeeded. Does NOT prove malware execution, credential theft, or end-user traffic.",
  "commitSha": "939d3bd1b05ee09f0f4c2585a492f98da0fd066d",
  "lockfile": {
    "path": "tools/pnpm-lock.yaml",
    "contentHash": "sha256:04916898507a414af7e59f9083ade5f604a0358ae676ad216e50d0f605330f6d"
  },
  "workflowRunId": "25698962181",
  "ciJob": {
    "name": "Build (tools)",
    "conclusion": "success"
  },
  "serviceBuild": {
    "provider": "cloudflare",
    "service": "websites-tools",
    "environmentLabel": "production",
    "checkRunId": "75454451577"
  },
  "snapshot": {
    "bookmark": "sgk:1:64656661756c74:64656661756c74:63656c6c2d30:15",
    "readEpoch": 15
  },
  "mode": "online"
}
Raw receipt ↗
07 / Intermission

EXPOSED

One compromised package. One build. One provable path, held together by a single commit SHA.

08 / Difference

What this is not.

npm audit / Dependabot

Flags that a version is present or vulnerable.

Proves a specific historical build resolved it during the window, or says UNPROVEN.

CVE / advisory dashboards

Track advisories and package metadata.

Ties one incident to one repository's commit, CI job, and production build, with source links.

SBOM scanners

Enumerate the dependencies inside an artifact.

Correlates lockfile, frozen-install CI, and a same-SHA production build into one path.

Reading the CI badge

Trusts the overall run's colour.

Uses the named job's own conclusion, so a red matrix cannot hide a green build.

09 / Read the receipt

Read the
receipt.

View the EXPOSED receipt ↗Code on GitHub ↗