TanStack Considers Anti-Social Coding

After a worm had its way with their GitHub Actions, TanStack is thinking about making their project invitation-only. The open-source dream is slowly being murdered by configuration errors.

Source: The Register

The Full Story

Severity: Medium Mood: Frustrating

The Shai-Hulud worm has caused such a headache for TanStack that they are now weighing the nuclear option of banning unsolicited pull requests entirely. This comes after a GitHub Actions misconfiguration allowed a poisoned cache to run riot, proving yet again that convenience is usually just a synonym for vulnerability. Maintaining project integrity now apparently requires turning the repo into a private club, forcing developers to rethink how they handle automated workflows.

#gitgonebad #shaihulud

Open article →