Malicious TanStack Package Abuses Postinstall Script to Steal Developer Secrets

A malicious unscoped npm package impersonating the TanStack ecosystem was published with a hidden postinstall hook (versions 2.0.4–2.0.7) that read .env* files and system metadata and exfiltrated them to a Svix webhook; developers should check lockfiles/node_modules for the affected versions, assume compromise if present, rotate exposed credentials, audit CI/CD builds, and monitor outbound traffic to api.svix.com.