News for hackers. Stuff that matters.

A comment on Postmortem: TanStack npm supply-chain compromise. Parent comment

Re:Postmortem: TanStack npm supply-chain compromise by Ferret7446 on Monday May 11, 2026 @10:15PM (#48103399)
That is one of many reasons to keep your dotfiles under version control.
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by lrvick on Monday May 11, 2026 @10:46PM (#48103610)
Someone that can wrap your sudo binary can wrap you git binary too. Once your OS is compromised all bets are off.
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by lpribis on Monday May 11, 2026 @10:26PM (#48103494)
How would that help? Unless you happen to check the dotfiles git diff before running _anything_. I guess this could be put in prompt or some cron job to detect diffs but I bet absolutely nobody does this.
[ Parent | on HN ]