Your npm Install Just Ran Someone Else's Code: Why Dependency Security Has to Start Before CI
- Created
- 21 Jul 2026
- Last reply
- 3 months ago
- Replies
- 0
- Views
- 0
- Reactions
- 0
Discussion of the blog article Your npm Install Just Ran Someone Else's Code: Why Dependency Security Has to Start Before CI.
A pull request checkout, a poisoned GitHub Actions cache, and an OIDC token pulled straight out of runner memory. That's how 84 malicious versions of TanStack's packages hit npm in six minutes.
Discussion thread — share findings, corrections and follow-ups below.