Static analyzers like https://github.com/zizmorcore/zizmor can help find such mi...

lknuth 4 months ago | parent | context | favorite | on: Postmortem: TanStack NPM supply-chain compromise

Static analyzers like https://github.com/zizmorcore/zizmor can help find such misconfiguration. It is however unfortunate, that such footguns aren't harder to fire.

jherdman 4 months ago [–]

Many thanks for sharing this. I wasn't aware it existed.