Post

84 TanStack npm package artifacts were compromised in the ongoing Mini Shai-Hulud supply chain attack, adding suspected CI credential-stealing malware. Socket flagged every malicious version within six minutes of publication. Details: socket.dev/blog/tanstac...

“the attacker used an orphaned commit to gain access to the workflow run that stores the OIDC token, effectively bypassing the project’s existing publishing protections” well, wait: an external fork had access to the OIDC token? how?

Probably pr target trigger again 😬 It runs the action in the context of the source repo but using the code from the fork. Tough one to keep secure

More or less; yes. We'll have more information in a blog post, but for now we're locking things down and fixing the problem. We have a good understanding of how this attack vector was carried about

It sounds like it wasn't. 😭

Why not? The workflow literally can't run if you have this set.

Just to confirm, it wasn’t. pull_request_target bypasses this setting