This was a GitHub Actions hack, nothing related to publishing on npm was comprom... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

squidsoup 4 months ago | parent | context | favorite | on: Postmortem: TanStack NPM supply-chain compromise

This was a GitHub Actions hack, nothing related to publishing on npm was compromised.

rdg1991 4 months ago [–]

No way to prevent this, says only CI platform (owned by the same company who owns the package manager) where this regularly happens.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact