Fake TanStack npm Package Exfiltrates Sensitive Developer Data

Researchers detected an active supply-chain attack: a malicious unscoped npm package named "tanstack" impersonated the official @tanstack scope and, via post-install scripts, silently searched for and exfiltrated environment files and sensitive credentials. Multiple malicious versions were pushed in rapid succession; victims are advised that credentials present at install time must be considered compromised and rotated immediately.