Re:Postmortem: TanStack npm supply-chain compromise
by mort96 on Tuesday May 12, 2026 @08:32AM
(#48107325)
It's extremely rare that I install a dependency without executing code from it shortly after. I think postinstall scripts are unfortunate and an anti-pattern, but I don't realistically think that their removal would do very much to avoid these kinds of attacks.
[ Parent
| on HN ]
Re:Postmortem: TanStack npm supply-chain compromise
by staticassertion on Tuesday May 12, 2026 @01:22PM
(#48111319)
You should sandbox where you run the code. The thing is, it's very hard for me to know how to sandbox an install script, but it's actually quite easy (and my responsibility as the app dev) to know how to sandbox my tests/ application.