Moment at 1:56 in A single PR just hijacked the NPM registry... by Fireship.
The attackers compromised the Tanstack repository by leveraging the **pull request target** workflow trigger, which allowed code from a closed fork PR to run with the main repository's elevated permissions
Saved by AironD.