varunsharma07
17 hours ago
Postmortem: TanStack NPM supply-chain compromise
On 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publ...