Security·
TanStack published its npm supply-chain postmortem. The attack chained three GitHub Actions flaws.
Attackers compromised 42 TanStack packages through a pull_request_target exploit, cache poisoning, and OIDC token theft. An external researcher caught it in 20 minutes.