Shai Hulud attack ships signed malicious TanStack, Mistral npm packages
… According to TanStack's post-mortem report from TanStack, the attackers chained three vulnerabilities: a risky ‘pull request-target’ workflow, GitHub Actions cache poisoning, and OIDC token theft from runner memory. …
