“TanStack”: Malicious Name-Squatting Campaign Steals Environment Secrets

**Supply-chain npm package exfiltrated environment secrets:** A malicious unscoped package published as `tanstack` (v2.0.4–2.0.7) included a postinstall.cjs that collected .env files and sent them via Svix webhooks; the actor iterated four rapid releases to test and optimize exfiltration and stealth. Immediate actions recommended are to check installs/package-locks, revoke exposed tokens (AWS, GitHub, npm), and audit logs and network traffic for api.svix.com.