TLDR Tech / Dev
Postmortem: TanStack npm supply-chain compromise
A supply-chain compromise on May 11 resulted in the publication of 84 malicious versions of 42 TanStack npm packages after an attacker chained together GitHub Actions vulnerabilities to exfiltrate credentials and inject malware into the release workflow.
Read the full story