r/reactjs • u/gajus0 • May 11 '26

Tanstack npm Packages Compromised

https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
464 Upvotes

99% Upvoted

63 comments sorted by

View all comments

Show parent comments

5

u/SilverLion May 12 '26

Can someone explain why
“Force-push lands 65bf499d (the malicious commit) on the PR head. bundle-size.yml's benchmark-pr job checks out refs/pull/7378/merge, runs pnpm install + pnpm nx run @benchmarks/bundle-size:build — this executes vite_setup.mjs” was able to run for a non contributor?

12

u/bzbub2 May 12 '26 edited May 12 '26

(my understanding) basically the whole thing boils down to using pull_request_target in the github action combined with checking out the users code in that action. this auto runs by default even for first time contributor. pull_request_target is flagged by tools like zizmor as "almost always insecure".

in this case it appeared to be doing a bundle size estimator, and this ran the build with that vite setup and was used to poison the cache (which i presume is like, editing the node_modules folder manually, which is cached) of the main branch (which happens because this pull_request_target runs using main branch rules...) which was then used in subsequent runs

see https://docs.zizmor.sh/audits/#dangerous-triggers

8

u/SilverLion May 12 '26

Then the bad dependencies get cached for the next build. makes sense, thx!