TanStack npm Brand-Squat

What it is

The unscoped npm package tanstack (maintainer sh20raj), a brand-squat of the legitimate @tanstack/* scope, shipping a malicious postinstall hook in versions 2.0.4–2.0.7 that reads dotenv files and POSTs them to a Svix ingest URL. All four versions were published within a 27-minute window, and share one Svix source ID — evidence of a deliberate, planned attack rather than a gradual compromise.

How it works

The postinstall.js script defines collectEnvFiles(), which resolves the parent directory (path.resolve(__dirname, "..")), filters for any file named .env or starting with .env., reads each, and bundles them into a JSON payload alongside package version, node version, platform and arch. The exfiltration function is named sendReadme() to look innocuous. The payload is POSTed to a hardcoded Svix ingest endpoint used as a one-way dead-drop: anyone can POST to the URL, but only the authenticated account holder can read the contents, so defenders cannot probe or enumerate what was captured.

The scope of harvesting and the tradecraft shift across versions:

• v2.0.4 / v2.0.5: staged as README.md; v2.0.5 also touches AGENTS.md
• v2.0.6: broadens from specific dotenv names to .env.* (all variants)
• v2.0.7: console.log calls commented out to run more quietly

The same Svix source ID (src_3387PLMB2uhXOBe3Q8sHu) appears in all four, tying them to a single controlled inbox.

Preconditions / Affected

Any environment that installed unscoped tanstack at 2.0.4–2.0.7 with .env files present in the parent directory at install time — CI/CD pipelines, developer machines, and container build environments. The package is unscoped; legitimate TanStack is always under @tanstack/*, so exposure comes from a dependency naming tanstack (the page lists npm/portalapp@1.0.0 as a known dependent).

What to do

• Check package.json, package-lock.json, and yarn.lock for an unscoped tanstack dependency and remove it; use only @tanstack/* packages.
• Block api.svix.com from CI/CD pipelines, developer machines, and container build environments.
• Treat any secrets in .env, .env.local, .env.production (or any .env.*) as compromised on affected hosts and rotate them — the dead-drop design means you cannot confirm what was read.

Caveats

The maintainer claims (in a now-deleted X post) the exfiltration code was leftover "random testing" with an AI agent that he "forgot to remove" while studying for exams; the page rejects this as changing impact. It is also unstated whether the account was compromised or the maintainer acted directly. A full technical analysis was still underway at publication, and 2.0.7 is only the last known malicious version — later versions may exist.