TanStack npm Supply Chain Attack: What Happened and How to Protect Your Projects
TanStack packages were compromised in a mass npm supply chain attack. Here's a deep-dive into what happened, how the attack worked, and the concrete steps every JavaScript developer must take to protect their projects right now.
5 min readjavascriptsecuritynpm
Minimum Release Age: npm, pnpm, Yarn, Bun and Deno Settings
Fix npm's “min-release-age is not a valid npm option” error, then set the same cooldown in pnpm, Yarn, Bun and Deno: copy-paste config, units and versions.
8 min readjavascriptnpmsecurity
npm RFC: Making Install Scripts Opt-In — A Deep Dive into What It Means for JavaScript Security
A landmark npm RFC proposes making install scripts opt-in by default. This deep-dive covers how the current system works, why it's dangerous, what the RFC proposes, the tradeoffs involved, and how you can protect yourself right now.
8 min readjavascriptnpmsecurity
