Re:Postmortem: TanStack npm supply-chain compromise
by maxloh on Tuesday May 12, 2026 @02:23AM
(#48104876)
I think it was an afterthought in the design. CI cache should be scoped per-user, or at least per-group.
If a workflow run by a maintainer (with access to secrets) can pull a cache tarball uploaded by a random user on GitHub, then it’s a security black hole. More incidents like this are inevitable.
If a workflow run by a maintainer (with access to secrets) can pull a cache tarball uploaded by a random user on GitHub, then it’s a security black hole. More incidents like this are inevitable.