Contain compromised npm publishing workflows

The 28 October 2026 Roundtable material shows that valid npm provenance was not a sufficient safety boundary for Shai-Hulud: a legitimate TanStack-related publishing workflow could produce packages after untrusted pull-request activity influenced a cache used by a privileged release job.

That makes continued release promotion risky wherever the same cache, runner, dependency path, lifecycle-hook execution, or accessible credentials remain in use.

Immediate scoped containment limits further artifact production and credential exposure while preserving unrelated npm builds that have no demonstrated connection to the compromised path.

Affected populations are: (1) operators of TanStack-related npm publishing workflows in which untrusted pull-request activity could influence a cache later consumed by a privileged release job with id-token: write; their releases can carry valid npm provenance despite the earlier compromise; (2) maintainers of runners and jobs that could read publishing credentials or OIDC material, because those credentials may require suspension, rotation, or use review; (3) owners and consumers of releases and derived artifacts produced through implicated workflows, caches, dependencies, or npm lifecycle hooks, because those artifacts require reconstruction and clean rebuilding; and (4) security and build-platform teams responsible for lockfiles, workflow logs, cache identifiers, package-manager records, and process telemetry needed to establish scope.

Unrelated npm workflows without a demonstrated connection to those paths are outside the freeze. The packet does not identify exact affected package versions or integrity hashes.

1. The supply-chain analyst's 28 October 2026 analysis supports the decision by showing that legitimate TanStack-related publishing infrastructure produced packages with valid npm provenance after an earlier trust boundary failed: untrusted pull-request activity could influence a cache consumed by a privileged release workflow with id-token: write. It also reports that malicious code read runner memory to obtain an OIDC token.
2. The decision scout's evidence synthesis supports containment at privileged cache reuse, npm lifecycle-hook execution, stale dependency records, and credentials accessible to affected jobs rather than at provenance verification alone.
3. The first evidence-auditor assessment supports freezing affected publishing workflows and derived artifacts, suspending or rotating credentials available to implicated jobs, invalidating suspect caches, reviewing lifecycle-hook execution, and rebuilding from reviewed commits and lockfiles. It contradicts a blanket freeze of unrelated npm builds.
4. The second evidence-auditor assessment qualifies that support with an evidence gap: the packet does not identify the exact versions, hashes, cache lineage, execution windows, runners, or credentials in local scope. It supports using authoritative indicators and local telemetry before applying or lifting the freeze.

The supply-chain analyst identified the failed trust boundary: untrusted pull-request activity could influence a cache later consumed by a privileged TanStack-related release workflow with id-token: write.

Valid npm provenance therefore did not establish that the resulting code was benign. The decision scout translated that mechanism into scoped containment of implicated workflows, caches, credentials, and derived artifacts.

The evidence auditor supported those actions but identified a central gap: the packet does not determine which local releases, runners, caches, or credentials are affected.

The Roundtable resolved that uncertainty by requiring local lockfiles and telemetry to define scope instead of freezing every npm build. The boundary reviewer found that this guidance could be shared without exposing private indicators.

The linker found no prior record, and the arbiter selected a new operational-action record.