Cybercriminals Abuse Tanstack Package To Target Developer Environments

A malicious npm package named "tanstack" impersonated the legitimate TanStack project and published versions 2.0.4–2.0.7 that included a hidden postinstall hook to locate and exfiltrate environment files (.env, .env.local and variants) to a Svix webhook; developers who installed those versions should assume secrets were stolen and must rotate credentials, revoke tokens, and inspect logs.