News for hackers. Stuff that matters.

A comment on Postmortem: TanStack npm supply-chain compromise. Parent comment

Re:Postmortem: TanStack npm supply-chain compromise by ghost_pepper on Monday May 11, 2026 @08:05PM (#48102446)
yes, they used pull_request_target for a benchmarking suite. github has a huge warning saying to never use pull_request_target to run user code, but this is just going to keep happening
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by riknos314 on Monday May 11, 2026 @09:07PM (#48102924)
> github has a huge warning saying to never use pull_request_target to run user code

This is an area where documentation is necessary but not sufficient. Github needs to add some form of automated screening mechanism to either prevent this usage, or at the very least quickly flag usages that might be dangerous.

[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by hombre_fatal on Tuesday May 12, 2026 @07:42AM (#48106870)
"pull_request_target" vs "pull_request" is also bad naming. At least give it a dangerous name so people know there's a dangerous quirk to it when reading their config.
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by qudat on Monday May 11, 2026 @11:10PM (#48103742)
And a labeling action which requires `pull_request_target`: https://github.com/actions/labeler#create-workflow

These types of features are not worth it and need to be removed from the marketplace.

[ Parent | on HN ]