## Summary
Adds a new policy `TanStack supply-chain attack - not affected` to the 💻
Workstations fleet that checks `npm_packages` on macOS, Windows, and
Linux hosts for any of the known-malicious `@tanstack/*` package
versions involved in the recent supply-chain compromise.
The policy returns **1 (passing)** when no compromised package/version
pair exists on the host, and **fails** when at least one match is found
— making it easy to triage affected workstations from the Fleet UI.
## Changes
- New file: `lib/all/policies/tanstack-supply-chain-attack.yml` — the
policy definition.
- Updated: `fleets/workstations.yml` — registers the new policy under
the `policies:` list.
## Notes
- `calendar_events_enabled` is left at the default (off).
- Platform is set to `darwin,windows,linux` because the `npm_packages`
osquery table is cross-platform and developer dependencies can land on
any workstation OS.
- Resolution guidance instructs users to remove/downgrade the affected
packages and rotate any developer credentials that may have been
exposed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Detect compromised npm packages on workstations (cross-platform) with
remediation guidance.
* Enforce per-user npm "min-release-age" on macOS, Linux, and Windows
with automated remediation.
* Add a host label for machines reporting an npm package inventory.
* **Chores**
* Add cross-platform scripts to automate updating per-user npm
configuration.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45264)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
