Re:Postmortem: TanStack npm supply-chain compromise
by wavemode on Monday May 11, 2026 @07:35PM
(#48102227)
You seem to be interpreting "please be careful when..." as "don't". I'm not sure how that interpretation makes any sense. Obviously they just mean, first kill the service (or better yet, shutdown the machine entirely) and then revoke the token...?
Re:Postmortem: TanStack npm supply-chain compromise
by yuzuquat on Monday May 11, 2026 @07:46PM
(#48102314)
my understanding is that careful means cleaning up the dead-man’s switch before revoking
Re:Postmortem: TanStack npm supply-chain compromise
by mosen on Tuesday May 12, 2026 @02:42AM
(#48104993)
Did you miss the part about the script that nukes your home folder?
Re:Postmortem: TanStack npm supply-chain compromise
by CodesInChaos on Tuesday May 12, 2026 @06:14AM
(#48106242)
Here being careful about revocation means:
Make sure to have an up-to-date backup, that's offline, or at least not mounted on the affected computer.
Check for the dead-man switch, and if present, disarm it.
Only then revoke the tokens. Instead of immediately revoking the tokens, like one would normally do. Nobody is suggesting to keep the compromised tokens active longer than necessary.
And what? Just let the actor just keep using them to spread to other people?
Always rotate your tokens immediately if they're compromised.
If it hurts, well, that sucks. …but seriously, not revoking the tokens just makes this worse for everyone.
A fair comment would have been: “it looks like the payload installs a dead-mans switch…”
Asking the maintainers not to revoke their compromised credentials deserves every down vote it receives.