TGViewer
DevOps & SRE notes DevOps & SRE notes @devops_sre_notes · 13.3K subscribers
Post #2698 2.93K
Technical postmortem detailing a sophisticated supply-chain compromise of the TanStack ecosystem on May 11, 2026

https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
TanStack Postmortem: TanStack npm supply-chain compromise | TanStack Blog On 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 malicious versions across 42 @tanstack/* packages on npm.…
  • 👍 4
  • 👏 1
Open in Telegram All posts from @devops_sre_notes
More from @devops_sre_notes
  1. Sep 24, 2026Post #2749
  2. Sep 23, 2026Post #2747
  3. Sep 22, 2026Realtime log viewer with web UI, tail -f for logs with a web interface browser. https://gi…
  4. Sep 21, 2026Securing every Kubernetes workload at scale — LinkedIn Engineering https://www.linkedin.co…
  5. Sep 18, 2026Validate environment variable usage in codebase https://github.com/Chrilleweb/dotenv-diff
  6. Sep 17, 2026Failure is inevitable: Learning from a large outage, and building for reliability in depth…
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →