TanStack npm Compromise: A Postmortem Report
- TanStack’s npm packages were compromised due to a supply-chain attack.
- The attacker used a dead-man’s switch to delete user files if the token was revoked.
- npm’s security policies and GitHub’s trust model are being questioned.
The Buzz Score
The Internet’s Verdict: 70% Hyped, 30% Skeptical
Forum Voices
Developers are expressing their concerns about the compromise and the security of npm packages.
Please be careful when revoking tokens. It looks like the payload installs a dead-man’s switch at ~/.local/bin/gh-token-monitor.sh as a systemd user service (Linux) / LaunchAgent com.user.gh-token-monitor(macOS). It polls api.github.com/user with the stolen token every 60s, and if the token is revoked (HTTP 40x), it runs rm -rf ~/.
Some developers are criticizing GitHub’s trust model and the use of postinstall scripts.
Postinstall scripts are deadly. Everyone should be using pnpm. Crazy that an ‘orphan’ commit pushed to a FORK(!) could trigger this (in npm clients). IMO GitHub deserves much of the blame here. A malicious fork’s commits are reachable via GitHub’s shared object storage at a URI indistinguishable from the legit repo. That is absolutely bonkers.
Conclusion
The TanStack npm compromise has raised concerns about the security of npm packages and the trust model of GitHub.
Focus Keyword: npm compromise
