@KaranVaidya6 > gained a foothold in an internal agentic tool
> The attacker demonstrated deep knowledge of our API surface and internal architecture
The call is coming from inside the house
FWIW, I think the best managers are the ones who are the best ICs as well. The rest of the team is forced to level up as a result and the manager never loses touch with the tech/product/community. I never really believed in the role of just "people managers".
🚨 How the TanStack npm attack actually happened:
1. Attacker opened a normal-looking pull request (#7378) on the TanStack repo.
2. GitHub automatically ran CI tests on that PR.
3. Code inside the PR stole the workflow's GitHub Actions Cache write token during the test run.
4. The attacker used that token to plant poisoned files in the shared build cache. The PR could be closed afterwards. The poisoned cache stays.
5. The official release workflow later pulled from the cache, baked the malicious files into the build, and signed and published 84 malicious package versions to npm.