just enabled a minimum age on npm package installs for my machine, should've done this sooner but if you haven't either here's a prompt for your coding agent to configure it for you:
""Find my package manager (bun/pnpm/npm/yarn) and configure a 3-day minimum-release-age / cooldown for installs to blunt supply-chain attacks. Exempt my workspace scopes. Verify the exact config key in current docs before writing."
SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.
This is crazy. The hacker installed a dead-man's switch that will wipe your computer if you revoke the GitHub token they stole from you. Revoking the token is what triggers the wipe.
>what do you think of the claude codebase?
brother, i'm not even reading my own code anymore. what makes you think i'm going to read someone else's?
@halbkass@ikkaveellaila Tõmbasin ka täna. Pehmelt öeldes sitanikerdis.
"Kasutamiseks lülita välja VPN", ütleb tal mulle, kui olen tavalise Telia 5G küljes. Ja kui ka kasutanuks VPN-i, siis miks see üldse probleem peaks olema?
Pärast seda veel mitu imelikku veateadet, enne kui sisse sain. E-riik 🤔
@nvk@BitcoinConner Buy EURT with USD, wait a month, then sell. There will be gain/loss, however small.
Not sure how it works over there exactly but in my country it’s absolutely retarded. Stablecoin is still a “digital asset” so doesn’t get the same exemptions as normal EUR/USD currency exchange.
Google has shipped a CLI for Google Workspace (Drive, Gmail, Calendar, Sheets, Docs, …) Huge!
Written in Rust, distributed through npm & https://t.co/egfC60tXum
$ npm i -g @googleworkspace/cli
$ npx skills add github:googleworkspace/cli
2026 is the year of Skills & CLIs
https://t.co/8jd16P5ncR