News for hackers. Stuff that matters.

A comment on Postmortem: TanStack npm supply-chain compromise. Parent comment

Re:Postmortem: TanStack npm supply-chain compromise by wereHamster on Monday May 11, 2026 @07:02PM (#48101910)
I'm looking forward to the analysis how the attacker managed to compromise CI. I was reading through the workflow and what immediately jumped out was a cache poisoning attack. Seems plausible, given https://github.com/TanStack/config/pull/381

edit: two hard things in computer science: naming things, cache invalidation, off-by-one errors, security. something something

[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by silverwind on Monday May 11, 2026 @07:27PM (#48102136)
Almost all these recent compromises seem to involve either cache poisoning or prompt injection via untrusted variables.
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by dgellow on Monday May 11, 2026 @08:45PM (#48102770)
Yes it is a GitHub actions cache poisoning attack
[ Parent | on HN ]