Post

Jack
@jackvalinsky.com

@npmx.dev idk if it would be useful to have a way of putting a message on a package that says: "hey maybe don't use this right now, we have reports from trusted sources that bad stuff is happening" like some kind of moderation for packages

Corbin Crutchley
@crutchcorn.dev

We actually rolled this out within an hour of the GitHub issue reporting it. We `npm deprecated` every impacted package with a message pointing to the issue as we continued our investigation. We really really tried to limit the damage as quickly as we could. We're determined to win back confidence

Corbin Crutchley
@crutchcorn.dev

We (TanStack) never claimed there was no way to prevent this fwiw. While we don't think any of our systems were blatantly errant, they clearly broke down today. This is why we wanted to make our changes as transparent as possible and published in our postmortem: tanstack.com/blog/npm-sup...

tanstack.comPostmortem: TanStack npm supply-chain compromise | TanStack BlogOn 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 mal...
Nicolás Alvarez
@nicolas17.xyz

I'm just referring to the fact that these issues keep happening with GitHub Actions. It feels like the C language, yes you *can* write secure code but there's traps the whole way that you have to carefully protect against.

Corbin Crutchley
@crutchcorn.dev

Ahh. Gotcha, sorry for the misunderstanding. I absolutely agree that, in particular, that event flag needs more warning, scanning, and tooling built around it.