build1 publisher
A compromised TanStack pipeline signed 84 poisoned packages with valid provenance
Attestation proves a package came out of the pipeline it names. When the pipeline is the thing that was owned, the seal still verifies, and a gate that only checks origin passes all 84 versions pushed on May 11.
Publishers:dev.to
Reality
- Evidence45
- Adoption45
- Hype gap+12
- Incentives30
- Confidence50