TanStack npm supply-chain attack: how a Dependabot bump spread a worm

DEV Community·0 points·axrisi·about 3 hours ago·dev.to

TanStack npm supply-chain attack, step by step: a poisoned CI cache, 84 bad versions, then a Dependabot bump that republished 22 packages in 95 minutes.

Read the full article at dev.to →

#npm #supply #chain #tanstack #dependabot #bump #attack #tanstack npm

Related stories

An undercover Google analyst infiltrated a notorious supply-chain hacking gangarstechnica.com
Ars Technica · 0 points · 11 days ago
TanStack supply-chain attack exposed ~170 private CrowdSec reposcrowdsec.net
Hacker News · 6 points · 11 days ago
Keyv and friends compromised in npm supply chain attackaikido.dev
Lobsters · 5 points · about 2 months ago
Anthropic is a supply chain risk for all of usbuilding138.com
Hacker News · 1 points · 3 days ago
Tracing the Supply Chain Attack on Androidkrebsonsecurity.com
Lobsters · 3 points · over 7 years ago
An Undercover Google Analyst Infiltrated a Notorious Supply-Chain Hacking Gangwired.com
Hacker News · 2 points · 10 days ago

Related topics

packages14 fake express3 worm4 express7 linux203 linux worm3 fake18 attack25 chain28 supply18 compromised8