Post

lavamoat.github.ioHarden your local development environmentA guide on how to settings that minimise the risk of local dev compromise.

I'd be happy to help roll out `@lavamoat/allow-scripts` and some good defaults from lavamoat.github.io/guides/harde... to tanstack/start. It's make repositories using it immune to the entire class of attacks like the one used in malware that hit you.

12/5/26, 8:59 am0 reposts2 likes

Corbin Crutchley

@crutchcorn.dev

We'd be super down, thank you. Let me know how I can help facilitate

I'm leaving for JSHeroes tomorrow, but maybe that's an opportunity to kickstart it in-person. I know @tkdodo.eu is gonna be there. Maybe someone else too? Regardless, I need someone who'd like to work with me and has enough expertise in how the project is set up to be able to push back /

when I try to make it too strict. We need a good balance between security and DX, otherwise people will just throw security out.

Dominik 🔮

@tkdodo.eu

Will definitely talk to you about that tomorrow !

hayesmaker64

@c64cade.com

"more resistant" !== "immune"

Thanks, I meant immune 😁 With the right tools and configurations you can prevent all known install-time attack vectors. As a result, the malware would be forced to rely on people running the software from the package, which is much less common than simply having it in the dependency tree.