
Salvatore
2.5K posts

Salvatore
@dested
2 time exited founder, Fractional CTO, Lifelong Software Engineer https://t.co/b0wwHhGVeM teaching kids to code Built and sold https://t.co/LIkwDgjoin


🚨 How the TanStack npm attack actually happened: 1. Attacker opened a normal-looking pull request (#7378) on the TanStack repo. 2. GitHub automatically ran CI tests on that PR. 3. Code inside the PR stole the workflow's GitHub Actions Cache write token during the test run. 4. The attacker used that token to plant poisoned files in the shared build cache. The PR could be closed afterwards. The poisoned cache stays. 5. The official release workflow later pulled from the cache, baked the malicious files into the build, and signed and published 84 malicious package versions to npm.





Happy to announce TSRX. Think it as the spiritual successor to JSX. We extracted it from Ripple, and made it framework agnostic. It can compile to React, Ripple and Solid, other frameworks to come soon. It's a TypeScript superset language, with a parser, compiler and a selection of plugins for editors + Prettier + ESlint, etc It's early alpha but we thought people might be interested in it. 🧵


25 years later and nothing has topped this ending



















