Active supply chain attack against NPM

[Malexandra-de]

Right now there's an active attack aimed at stealing credentials and compromising npm packages.
https://www.aikido.dev/blog/mini-shai-hulud-is-back-tanstack-compromised
This can apparently be exploited by running gitlab pipelines pulling compromised versions, so this project might be vulnerable.

[felddy]

Thank you for the heads up. I appreciate your vigilance! 💪

Due to my field of work, the security of this container is first and foremost, and I am tracking this attack.

This morning's build of the container (24 minutes ago) shows no detected vulnerabilities in the dependencies.
Vulnerability reports are generated for each platform and attached as an attestation to the image.

You can view the two different types of reports directly in GitHub:

The container alone:

• https://github.com/felddy/foundryvtt-docker/actions/runs/25732249078/job/75560428877#step:21:240

The container with FoundryVTT installed:

• https://github.com/felddy/foundryvtt-docker/actions/runs/25732249078/job/75560463711#step:21:239

Thank you again. Please continue to feel free to ping me whenever you have a security concern about the container.

If you find a vulnerability you can report it here:

• https://github.com/felddy/foundryvtt-docker/security