Post

Earlier May 11th, many TanStack Router/Start packages were compromised, but quickly mitigated. Here is a full post mortem on the incident: tanstack.com/blog/npm-sup...

tanstack.comPostmortem: TanStack npm supply-chain compromise | TanStack BlogOn 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 mal...

Adam

@acdvs.dev

Really makes you wonder why so many huge projects have allowed untrusted code to touch a cache that touches trusted code.

12/5/26, 9:11 am0 reposts0 likes

No replies yet.