For fuck sake. When are GitHub going to stop linking dark fork commits to the official repo?
optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Commit 79ac doesn't exist in the repo and npm pulls it in as if it does.
This has been abused for over decade now.
github.com
Several npm latest releases are compromised · Issue #7383 · TanStack/router
We are actively investigating this security incident and sharing our findings here: www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem