Postmortem: TanStack npm supply-chain compromise
Hacker News Best2746 字 (约 11 分钟)
95
TanStack suffered an npm supply-chain compromise on May 11, 2026, where attackers published 84 malicious versions across 42 packages using GitHub Actions cache poisoning and OIDC token extraction without stealing npm tokens directly.
入选理由：Attackers exploited pull_request_target and GitHub Actions cache poisoning to publish 84 malicious versions in 6 minutes.
FeaturedArticle#Security#Supply Chain#npm#GitHub Actions#TanStack英文