> the Tanstack compromise is very likely to have been the leak vector
  ....appears to have been backdoored to extract an API key with authorization to read the private codebase.
  ...
  >  immediately rotated all required tokens & credentials to prevent further incidents.

Rotating the API key doesn't quite put them in a position to "prevent further incidents" does it? The next PyPI/npm supply chain issue will just get the new key?

I suppose whatever they use that key for should be reviewed and re-scoped if possible?

Does github let you restrict where you can originate requests using a given API key? or are we just not there yet?