Broken Verification and the New Security Architecture for AI-Powered Threats
In May 2026, 84 malicious package versions were published through TanStack's own CI/CD pipeline with cryptographically valid SLSA provenance attestations, spreading to 169 packages and 373 malicious v…