Hugo van Kemenade on Mythryl: “Do not use pull_request_target. Do not use caches in publish…”

Do not use pull_request_target. Do not use caches in publish workflows. Use dependency cooldowns. Use Zizmor. Tell GitHub to make Actions secure by default. #GitHub #GitHubActions

Corbin Crutchley@crutchcorn.dev

We at TanStack just had a major attack against our Router packages. We have a postmortem out now explaining what happened and how we mitigated the response: tanstack.com/blog/npm-sup... No other TanStack packages outside of the Router monorepo were impacted

tanstack.comPostmortem: TanStack npm supply-chain compromise | TanStack BlogOn 2026-05-11, an attacker chained a pull_request_target Pwn Request, GitHub Actions cache poisoning across the fork↔base trust boundary, and OIDC token extraction from runner memory to publish 84 mal...

12/5/26, 12:54 pm1 repost3 likes