TanStack NPM Supply-Chain Compromise

• TanStack’s NPM package was compromised due to a supply-chain attack.
• The attacker used a dead-man’s switch to install a malicious script.
• Experts recommend using pnpm and avoiding plaintext credentials on disk.

Executive Summary

The Internet’s Verdict: 70% Hyped, 30% Skeptical

Forum Voices

Please be careful when revoking tokens. It looks like the payload installs a dead-man’s switch at ~/.local/bin/gh-token-monitor.sh as a systemd user service (Linux) / LaunchAgent com.user.gh-token-monitor(macOS). It polls api.github.com/user with the stolen token every 60s, and if the token is revoked (HTTP 40x), it runs rm -rf ~/.

Postinstall scripts are deadly. Everyone should be using pnpm. Crazy that an ‘orphan’ commit pushed to a FORK(!) could trigger this (in npm clients). IMO GitHub deserves much of the blame here.

Conclusion

The TanStack NPM supply-chain compromise highlights the importance of security in the software development process.

Focus Keyword: NPM Compromise