TanStack Router hit by massive supply chain attack

This exploit breaks the "provenance equals safety" mental model by attacking the build pipeline itself rather than stealing maintainer keys.

• –Attackers bypassed OIDC "trusted publisher" protections by poisoning the pnpm cache, proving that even cryptographically signed releases can be malicious if the environment is compromised.
• –The inclusion of a "dead-man's switch" wiper that deletes the user's home directory upon token revocation is a malicious layer of retaliation designed to deter security response.
• –The malware's worm behavior, which uses stolen tokens to infect other packages maintained by the victim, creates a recursive threat that could cascade through the entire npm registry.
• –This event will likely accelerate the adoption of "dependency cooldowns" and the use of modern package managers like Bun that disable lifecycle scripts by default.