TanStack npm supply-chain compromise creates urgent demand for GitHub Actions and npm publishing hardening

速览

TanStack published a postmortem for a May 11 npm supply-chain compromise affecting 84 malicious versions across 42 packages through pull_request_target, cache poisoning, and OIDC token extraction.

主关键词

TanStack npm compromise

分类

Developer Security

受众

Open-source maintainers, DevSecOps teams, JavaScript developers, and CI platform administrators

窗口期

24-72 小时冲刺

执行难度

适合快速构建

评分

9 / 优先

来源日期

May 11, 2026

来源

查看原文

为什么现在

The incident is high on Hacker News and gives developers an immediate reason to audit CI workflows, npm trusted publishing, pull_request_target usage, cache keys, OIDC permissions, and install-host credential exposure.

Angles: TanStack npm compromise explained, GitHub Actions cache poisoning checklist, How to audit pull_request_target workflows, npm trusted publishing hardening guide

72 小时行动计划

1. 1核对来源和更新时间，确认 "TanStack npm compromise" 仍处在新窗口。
2. 2先发布一个聚焦页面，回答最直接的实现、采购或对比问题。
3. 3补一个清单、模板或小工具，把搜索意图转成邮箱订阅或线索。