Four published versions of a fake "tanstack" package uploaded in 27 minutes that want to steal your .env files

Reported 05 May 2026 by otx · Severity: medium

An attacker registered the unscoped 'tanstack' name on npm and published four malicious versions (2.0.4-2.0.7) within 27 minutes on April 29, 2026. These packages contained postinstall hooks that automatically exfiltrated environment files containing sensitive credentials when de