Yet another day where 'pull_request_target` is allowed to exist and cause tons o... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

anonymousab 45 days ago | parent | context | favorite | on: Postmortem: TanStack NPM supply-chain compromise

Yet another day where 'pull_request_target` is allowed to exist and cause tons of pain. They really ought to kill it off by now.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact