The TanStack Heist, TeamPCP Files Episode 01

In plain terms: CI saves downloaded packages so the next build skips re-fetching. The cache does not authenticate writers; it reads back whatever the last writer left.

In plain terms: A fork PR usually runs with the fork's permissions, which are nothing. pull_request_target flips that. It runs with the repo owner's permissions instead.

In plain terms: Attacker code now runs as if the maintainer wrote it. It is not sandboxed off; it shares the runner with the rest of the trusted job, and it writes to the same cache the next release will read.

In plain terms: The maintainer never has to touch the attacker's PR. Any later merge to main by anyone, on any unrelated change, is enough to trigger the trusted release run that picks up the poisoned cache.

In plain terms: Cache lookups are not exact-match. restore-keys is a prefix-fallback list. The attacker's entry shares the prefix the release job falls back to, so the release loads the attacker's bytes instead of building fresh.

In plain terms: Steps in one GHA job share the same UID on the same runner; they are not isolated processes. The poisoned step does not bypass a trust boundary, because no boundary exists between it and the trusted publish step it lives next to. So it reads memory and walks the OIDC token out.

In plain terms: npm trusted publishing is not failing here, it is working exactly as designed. The token was minted by the real release workflow, signatures verify, provenance attestations chain back to a runner that GitHub really did spin up for this repo. None of that proves the publish is benign. It only proves the publish came from the runner, which is a much weaker claim than most teams assume when they enable provenance.

key: pr-${{ github.event.pull_request.number }}-...

environment: production

In plain terms: Scoped cache keys stop the PR cache from being restored by the release run. An environment: with required reviewers stops the publish job from minting an OIDC token without a human in the loop. Neither fix is exotic. Most repos that took the May 11 hit had both controls missing.