Hardening My Repos Against the Shai Hulud npm Attack
The Shai Hulud worm hit TanStack and 170+ other npm packages by poisoning a pnpm store cache in GitHub Actions. Here is how the attack worked and the concrete steps I took to harden my own projects against it.