Post

Corbin Crutchley
@crutchcorn.dev

We (TanStack) never claimed there was no way to prevent this fwiw. While we don't think any of our systems were blatantly errant, they clearly broke down today. This is why we wanted to make our changes as transparent as possible and published in our postmortem: tanstack.com/blog/npm-sup...

tanstack.comPostmortem: TanStack npm supply-chain compromise | TanStack BlogOn 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 mal...

0 reposts2 likes

Nicolás Alvarez
@nicolas17.xyz

I'm just referring to the fact that these issues keep happening with GitHub Actions. It feels like the C language, yes you *can* write secure code but there's traps the whole way that you have to carefully protect against.

Corbin Crutchley
@crutchcorn.dev

Ahh. Gotcha, sorry for the misunderstanding. I absolutely agree that, in particular, that event flag needs more warning, scanning, and tooling built around it.