Static analyzers like https://github.com/zizmorcore/zizmor can help find such mi... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

lknuth 77 days ago | parent | context | favorite | on: Postmortem: TanStack NPM supply-chain compromise

Static analyzers like https://github.com/zizmorcore/zizmor can help find such misconfiguration. It is however unfortunate, that such footguns aren't harder to fire.

jherdman 77 days ago [–]

Many thanks for sharing this. I wasn't aware it existed.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact