Tag

pull-request-target

Name: Safeguard
Brand: Safeguard
Availability: PreOrder

Safeguard articles tagged "pull-request-target" — guides, analysis, and best practices for software supply chain and application security.

1 article

Software Supply Chain Security

TanStack's Build Pipeline Got Hijacked and Still Signed Valid SLSA Provenance (May 2026)

On May 11, 2026, attackers chained a pull_request_target abuse, cache poisoning, and OIDC token theft to publish 84 malicious @tanstack npm versions from TanStack's own trusted pipeline. It is the first npm compromise to carry valid SLSA provenance.

May 15, 202611 min read

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

Book a demo Get started

No sales call required, even your agent can complete the purchase over MCP.