by Tanner Linsley on May 11, 2026.
Last updated: 2026-05-11
On 2026-05-11 between 19:20 and 19:26 UTC, an attacker published 84 malicious versions across 42 @tanstack/* npm packages by combining: the pull_request_target "Pwn Request" pattern, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of an OIDC token from the GitHub Actions runner process. No...
This event illustrates several important patterns in cybersecurity threats. First, it demonstrates the potential for cascading effects when a widely-used piece of infrastructure is compromised. Second, it underscores the need for ongoing vigilance and proactive patching to protect against known vulnerabilities. Third, it highlights the importance of open-source software projects in the tech ecosystem, as they can serve both as valuable resources and potential points of weakness. Lastly, the inci...
