🦋 Live Bluesky Post

Matt Kane

@mk.gg

Good postmortem on the @tanstack.com supply-chain attack. The key part (which should be called out loudly): never run install on untrusted code inside a `pull_request_target` workflow. tanstack.com/blog/npm-sup...

Force-push lands 65bf499d (the malicious commit) on the PR head. bundle-size.yml's benchmark-pr job checks out refs/pull/7378/merge, runs pnpm install + pnpm nx run @benchmarks/bundle-size:build — this executes vite_setup.mjs

May 12, 2026 at 5:51 AM UTC

❤️ 56 Likes

🔄 12 Reposts

💬 0 Replies

📝 4 Quotes

Created: May 12, 2026 at 05:51 AM UTC

Indexed: May 12, 2026 at 05:51 AM UTC

Technical Details

Post URI: at://did:plc:uwbl4k3tza7eyjv3morkrld2/app.bsky.feed.post/3mln3v2o2fk2z

Content ID: bafyreigumzdcp3bxbttws5v2q7d4vpfsaehxicai3liry4cm2qojd7zzh4

Author DID: did:plc:uwbl4k3tza7eyjv3morkrld2

Languages: en

Live Collection Info

This post was fetched in real-time using the live Bluesky loader. The data is fresh and reflects the current state on Bluesky.

View on Bluesky ↗