TanStack shipped a postmortem for the 42-package npm compromise. Here is what every project should change this week.

TanStack disclosed that a GitHub Actions workflow flaw in its Router/Start monorepo let an attacker inject malicious code and poison build caches.

The attacker published 84 compromised npm versions across 42 packages, then the issue spread to additional projects before the releases were deprecated.

The incident highlights how a CI/CD mistake can reach a signed npm release and weaken trust in provenance attestations alone.

Security firms including StepSecurity and Wiz warned that build-pipeline controls need stronger safeguards against cache poisoning and workflow abuse.