Security

A Signed Release Can Still Be the Wrong Release

The May 2026 TanStack attack shows why SMBs need dependency review, isolated publish jobs, and automated SBOM and provenance checks before release trust becomes release risk.