Auditing the TanStack Supply Chain Compromise: Postinstall Scripts That Steal GitHub Tokens
pr0h0•
This post examines the TanStack npm supply chain compromise confirmed by Grafana, focusing on how malicious postinstall scripts stole GitHub tokens and enabled repository cloning, plus the practical defenses developers should apply.
supply-chain-securitynpmgithub