#npm

Mini Shai-Hulud Ships the First Malicious npm With Valid SLSA Provenance

TeamPCP compromised TanStack's CI to publish 84 malicious npm packages with valid SLSA Build Level 3 provenance, proving that cryptographic attestation cannot protect a.