🦋 Live Bluesky Post

Matt Kane's avatar

Matt Kane

@mk.gg

Matt Kane

I should add that while EmDash does use TanStack Router in its admin, the dependencies are pinned so EmDash sites should not be affected.

Good postmortem on the @tanstack.com supply-chain attack. The key part (which should be called out loudly): never run install on untrusted code inside a `pull_request_target` workflow. tanstack.com/blog/npm-sup...

Force-push lands 65bf499d (the malicious commit) on the PR head. bundle-size.yml's benchmark-pr job checks out refs/pull/7378/merge, runs pnpm install + pnpm nx run @benchmarks/bundle-size:build — this executes vite_setup.mjs
May 12, 2026 at 7:29 AM UTC
Created:
Indexed:

Technical Details

Post URI: at://did:plc:uwbl4k3tza7eyjv3morkrld2/app.bsky.feed.post/3mlnbcwe64s2i
Content ID: bafyreic6wjuevsos3hcjhlpd32wxhzwhg4vmrzqsgwklj6ckzke4xkvspu
Author DID: did:plc:uwbl4k3tza7eyjv3morkrld2
Languages: en

Live Collection Info

This post was fetched in real-time using the live Bluesky loader. The data is fresh and reflects the current state on Bluesky.

View on Bluesky ↗