TLDR Tech / InfoSec
Postmortem: TanStack npm supply-chain compromise
On May 11, an attacker used a pull_request_target workflow, GitHub Actions cache poisoning, and OIDC token theft from runner memory to push 84 malicious versions of 42 @tanstack/* npm packages. The payload ran during install, harvested cloud, Kubernetes, Vault, npm, GitHub, and SSH credentials, then exfiltrated them over the Session/Oxen network and tried to republish other packages owned by the victim. Detection came from external researchers within about 20 minutes. All bad versions were deprecated, caches purged, and workflows hardened.
Read the full story