Code for Victory ✌ Commit for Country 🇦🇺👨💻 #govtech #civictech #startups 👀 ex-public servant & #auspol ICT policy junkie 📑 now coder at @Swyftxglobal
Brisvegas
Joined May 2010
- Tweets1K
- Following3.8K
- Followers581
- Likes4.9K
Simon Victory retweeted
SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
github.com/TanStack/router/i…
Credit to the security researcher for responsible disclosure.
Simon Victory retweeted
Now that Obama’s poll numbers are in tailspin – watch for him to launch a strike in Libya or Iran. He is desperate.
Why doesn't any of the HUGE Australian banks have a live status page? Why do I have to wait for their mandatory reporting to @RBAInfo months later to confirm said outages. @CommBank you've got an NPP outage right now? Litearlly nowhere I can find info about it
Right-clicking the logo takes you to the brand guidelines, actually genius. Great attention to detail. Now a new slack emoji at work 😂 @tan_stack
Simon Victory retweeted
There are two types of software tools: those which no one uses, and those people complain about
Very disappointed in @Westpac for asking this sensitive info #CyberSecurity There isn't even a back button, the form is just shit. Needless to say, I'm looking for a different bank #openbanking can't come fast enough @up_banking @acccgovau @ConsumerData
tbh most governments are dogshit with security anyway. @ASDGovAu has their work cut out enforcing the essential 8 for @PublicServiceAU... and it's been *YEARS*
The @SECGov X account was compromised, and an unauthorized post was posted. The SEC has not approved the listing and trading of spot bitcoin exchange-traded products.
importance of 2FA
We can confirm that the account @SECGov was compromised and we have completed a preliminary investigation. Based on our investigation, the compromise was not due to any breach of X’s systems, but rather due to an unidentified individual obtaining control over a phone number associated with the @SECGov account through a third party. We can also confirm that the account did not have two-factor authentication enabled at the time the account was compromised. We encourage all users to enable this extra layer of security. More information and tips on how to keep your account secure can be found in our Help Center: help.x.com/en/safety-and-sec…
Thank fuck the new @ato_gov_au is built on NextJS. It's good #govtech
It's only taken 5ish years of various devs pushing to finally get traction.
If it was built with just @AusGovCMS I was going to get angry (headless is okay mind you)
This is interesting! architecture.digital.gov.au/ by @DTA 👏 Long gone is the absolutely thicc "Australian Government architecture reference models" textbook by the now dead AGIMO #govtech
