An attacker registered the unscoped 'tanstack' package name on npm and rapidly published four malicious versions containing postinstall scripts designed to steal environment files (.env) from developers' systems. These scripts exfiltrated sensitive credentials to an attacker-controlled Svix webhook endpoint. The campaign exploited name confusion with the legitimate @tanstack organization, a known publisher of popular JavaScript libraries. The attacker actively debugged and improved the payload during the brief window the packages were available, increasing the scope of stolen data. This represents a supply chain attack via package squatting and abuse of npm postinstall hooks.

If developers installed these malicious packages, their local environment files containing sensitive credentials (AWS keys, API tokens, database credentials, OAuth secrets) could have been exfiltrated to an attacker-controlled endpoint. This could lead to credential compromise and potential unauthorized access to cloud resources and services. The attack leverages supply chain trust and developer workflows, increasing the risk of widespread credential leakage. No known active exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Developers should verify that they have not installed any unscoped 'tanstack' packages, especially versions 2.0.4 through 2.0.7. Remove any such packages and rotate any potentially exposed credentials found in .env files. Use scoped package names (@tanstack) to avoid confusion and consider implementing package integrity verification. Monitor npm advisories and official @tanstack communications for updates.