TanStack has released a detailed postmortem describing a sophisticated supply-chain attack that compromised 42 npm packages and published 84 malicious package versions in just six minutes, exposing developers and CI/CD systems to credential theft and malware propagation. The attack exploited a combination of GitHub Actions cache poisoning, unsafe pull_request_target workflows, and runtime token extraction to […]

TanStack has released a detailed postmortem describing a sophisticated supply-chain attack that compromised 42 npm packages and published 84 malicious package versions in just six minutes, exposing developers and CI/CD systems to credential theft and malware propagation. The attack exploited a combination of GitHub Actions cache poisoning, unsafe pull_request_target workflows, and runtime token extraction to

TanStack has released a detailed postmortem describing a sophisticated supply-chain attack that compromised 42 npm packages and published 84 malicious package versions in just six minutes, exposing developers and CI/CD systems to credential theft and malware propagation. The attack exploited a combination of GitHub Actions cache poisoning, unsafe pull_request_target workflows, and runtime token extraction to