TanStack npm 供应链攻击事件复盘：OpenAI 的应急响应与你的防御清单

# 检查 package-lock.json 中所有 tanstack 相关包的版本与 integrity hash
# 如果 integrity 字段缺失或与官方发布不一致，说明可能有问题
grep -A2 '"@tanstack' package-lock.json | \
  awk '/"resolved"/ {print $2} /"integrity"/ {print $2}'

# 用 npm audit 检查已知恶意版本（npm 会在 advisories 中标记）
npm audit --production

# 更彻底：列出所有 tanstack 依赖的精确版本号，与 npmjs.com 上的官方版本对比
npm ls @tanstack/react-query @tanstack/react-table @tanstack/react-router 2>/dev/null

# 删除 node_modules 和 lockfile，从干净源重新安装
rm -rf node_modules package-lock.json
npm install --prefer-online

# .github/workflows/ci.yml — 在 install 之前校验 lockfile完整性
name: CI
on: [push, pull_request]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Verify lockfile integrity hashes exist
        run: |
          # 检查 package-lock.json 中是否所有包都有 integrity 字段
          MISSING=$(node -e "
            const lock = require('./package-lock.json');
            let count = 0;
            for (const [name, entry] of Object.entries(lock.packages || {})) {
              if (!entry.integrity) {
                console.log('NO integrity: ' + name);
                count++;
              }
            }
            if (count > 0) process.exit(1);
          ")
          echo "$MISSING"

      - name: Install dependencies
        run: npm ci

# 安装时要求 provenance 签名（npm 10+）
npm install @tanstack/react-query --require-provenance

# 或在 .npmrc 中全局启用
echo "require-provenance=true" >> .npmrc

// package.json — 不要用 * 或 x-range，锁定最小范围
{
  "dependencies": {
    // ❌ 危险：任何新版本都会被安装
    "@tanstack/react-query": "^5",

    // ✅ 更安全：只允许补丁级更新，且配合 lockfile
    "@tanstack/react-query": "~5.62.0"
  }
}

# macOS 码签名示例：用环境变量注入，不把 .p12 文件放在仓库里
# CI 中：
security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
codesign --sign "$DEVELOPER_ID" --timestamp --options runtime \
  dist/OpenAI.app

# 一次性生成当前所有依赖的 integrity 基线文件
node -e "
  const lock = require('./package-lock.json');
  const baseline = {};
  for (const [path, entry] of Object.entries(lock.packages || {})) {
    if (entry.integrity) {
      baseline[path] = entry.integrity;
    }
  }
  require('fs').writeFileSync('dependency-baseline.json',
    JSON.stringify(baseline, null, 2));
"

# 后续每次 npm install 后，对比基线是否发生变化
node -e "
  const lock = require('./package-lock.json');
  const baseline = require('./dependency-baseline.json');
  for (const [path, entry] of Object.entries(lock.packages || {})) {
    const expected = baseline[path];
    if (expected && entry.integrity !== expected) {
      console.error('INTEGRITY CHANGED: ' + path);
      console.error('  expected: ' + expected);
      console.error('  actual:   ' + entry.integrity);
    }
  }
"