POSTMORTEM: TANSTACK NPM SUPPLY-CHAIN COMPROMISE

Summary from the TLDR Dev newsletter

A supply-chain compromise on May 11 resulted in the publication of 84 malicious versions of 42 TanStack npm packages after an attacker chained together GitHub Actions vulnerabilities to exfiltrate credentials and inject malware into the release workflow.