#javascript

Your next supply-chain attack will come from a package you've never heard of

The TanStack npm compromise wasn't sophisticated — one maintainer's token was enough. Here are the three changes that actually shrink your blast radius.