hackernews.pink

Top Stories Trending New For You Bookmarks Pink Dossier

hackernews.pink

1097 points•465 comments•3w ago•by varunsharma07•tanstack.com ↗

Postmortem: TanStack NPM supply-chain compromise

TanStack reports that several npm releases may be compromised through a self-spreading supply-chain attack. The attack leverages an optionalDependencies entry to fetch a git commit from tanstack/router and run a malicious prepare script that loads a router_init.js payload, purportedly harvesting credentials and tokens and exfiltrating them. Multiple TanStack packages and versions are listed as affected, and investigators note the GitHub Actions OIDC trusted-publisher configuration tied to the publication process, suggesting the workflow itself may be compromised.

https://github.com/TanStack/router/issues/7383

Discussion (465)

No comments yet

Top
Trending
New
For You
Bookmarks
Dossier