TanStack Considers Invitation-Only Pull Requests After Supply Chain Attack

• •TanStack is considering invitation-only pull requests after a supply chain attack.
• •The Shai-Hulud worm exploited GitHub Actions, leading to a cache poisoning incident.
• •TanStack has implemented multiple security measures to mitigate future risks.

The TanStack team is evaluating security measures following a supply chain attack that exploited a GitHub Actions misconfiguration. The Shai-Hulud worm, used by TeamPCP, triggered a pull request that executed malicious code, poisoning a shared cache across the repository. In response, TanStack has removed the vulnerable pull_request_target feature from its CI pipeline and implemented several security enhancements, including disabling caches and pinning actions to commit SHA hashes. A drastic proposal under consideration is making pull requests by invitation only, a significant shift from the open-source model. While this could enhance security, it may deter contributions from the community. The team emphasizes that they will not transition to a closed-source model but may require discussions before PR submissions. The incident highlights broader concerns regarding supply chain security and GitHub's role in cache management.