The 20-Minute Compromise: CI/CD Audit Guide for the TanStack Supply Chain Attack

OIDC authentication worked correctly throughout the TanStack attack. The build cache is the substrate participant that wasn't governed. Here's the full audit checklist and the governance analysis that explains why OIDC alone can't prevent this attack class. The TanStack NPM supply chain attack compromised 84 package versions across 42 packages in approximately 20 minutes. The attack chain: pull_request_target misconfiguration → build cache poisoning → OIDC token extraction from runn...