The 20-Minute Compromise: CI/CD Audit Guide for the TanStack Supply Chain Attack

Short summary

The TanStack NPM attack poisoned build caches and extracted OIDC tokens, proving authentication alone cannot guarantee supply chain integrity. This audit guide covers five critical controls: workflow permissions, cache isolation, strict OIDC claim validation, token TTL, and post-compromise forensics.

• •Build cache poisoning bypassed OIDC by operating in a layer below authentication
• •Audit checklist covers pull_request_target misconfiguration, cache isolation, and OIDC claim strictness
• •Forensic checks include cache key analysis, node_modules inspection, and cloud provider logs

Generated with AI, which can make mistakes.