<?xml version="1.0" encoding="UTF-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
    <title>post-mortem</title>
    <link rel="self" type="application/atom+xml" href="https://links.pgmac.net.au/guest/tags/551/feed"/>
    <updated>2026-05-25T14:13:15+10:00</updated>
    <id>https://links.pgmac.net.au/guest/tags/551/feed</id>
            <entry>
            <id>https://links.pgmac.net.au/links/1838</id>
            <title type="text"><![CDATA[Postmortem: TanStack NPM supply-chain compromise]]></title>
            <link rel="alternate" href="https://tanstack.com/blog/npm-supply-chain-compromise-postmortem" />
            <link rel="via" type="application/atom+xml" href="https://links.pgmac.net.au/links/1838"/>
            <author>
                <name><![CDATA[Paul Macdonnell]]></name>
            </author>
            <summary type="text">
                <![CDATA[On 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 malicious versions across 42 @tanstack/* packages on npm. Full postmortem.]]>
            </summary>
            <updated>2026-05-12T20:24:21+10:00</updated>
        </entry>
    </feed>
