Four published versions of a fake "tanstack" package uploaded in 27 minutes that want to steal your .env files

An attacker registered the unscoped 'tanstack' name on npm and published four malicious versions (2.0.4-2.0.7) within 27 minutes on April 29, 2026. These packages contained postinstall hooks that automatically exfiltrated environment files containing sensitive credentials when developers ran npm install. The attacker exploited name confusion with the legitimate @tanstack organization, which publishes widely-used JavaScript libraries. The malicious code targeted .env files, stealing AWS keys, API tokens, database credentials, and OAuth secrets by sending them to an attacker-controlled Svix webhook endpoint. Version 2.0.6 was particularly dangerous, sweeping all .env variants in the working directory. The version history reveals live debugging by the attacker, who iteratively refined the payload targeting and stealth capabilities while the package remained publicly available with approximately 19,830 monthly downloads.

• Malicious Claude Code Extension Served in Cursor Supply Chain AttackNews2026-11-02
• Inside a malicious Claude Code-branded extension and its persistent SSH backdoorMalware2026-10-31
• $2 Million+ Drained From Polymarket Traders in New Supply Chain AttackNews2026-10-30
• Applying Security by Design and Cyber Immunity principles to protect AI systems | Kaspersky official blogAnalysis2026-10-29
• 26th October · Threat Intelligence ReportBreach2026-10-26