News for hackers. Stuff that matters.

A comment on Postmortem: TanStack npm supply-chain compromise. Parent comment

Re:Postmortem: TanStack npm supply-chain compromise by ssanderson11235 on Tuesday May 12, 2026 @08:12AM (#48107142)
Noone force-pushed to main in the actual repo. The attacker force-pushed to main in their own fork, but the actual repo had a CI job configured that ran code from the fork in response to changes in that fork.
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by corvad on Tuesday May 12, 2026 @08:39AM (#48107414)
Ah that makes more sense I was kind of confused by that.
[ Parent | on HN ]