Cybersecurity researchers have uncovered an active supply-chain attack targeting developers through the npm registry.
The Socket Research Team detected a malicious, unscoped package named “tanstack” that impersonates the legitimate TanStack organization. When developers mistakenly install this fake package, it silently steals sensitive environment variables from their machines. The stolen data is then automatically sent to a remote server controlled by the attacker.
This attack highlights the ongoing threat of brand squatting in open-source software repositories. The threat actor, operating under the maintainer account “sh20raj,” published four malicious updates in rapid succession over just 27 minutes today.
This tight timeline indicates a deliberate, well-planned attack rather than a gradual system compromise. Researchers automatically detected the malicious activity through threat detection systems that monitored unusual post-install behaviors.
The Brandjacking Incident
The fake package exploits the massive popularity of the official TanStack project, which securely publishes its code under the scoped “@tanstack/*” namespace.
By claiming the unscoped “tanstack” name, the attacker created a trap for developers who might make a typo or misunderstand the official naming conventions.
This package sat quietly on the npm registry for over a month before the maintainer introduced the malicious data-stealing code. This sudden shift from benign to malicious behavior is a common tactic for building initial trust before launching an attack.
The malicious code executes during installation via a post-install script. These scripts run automatically when a developer downloads the package, giving the attacker immediate access to the local file system.
The primary goal of the attack is to locate and steal files containing environment variables. These files typically store highly sensitive developer information, such as API keys, database passwords, and internal network configurations.
The attacker released several distinct versions of the package, each refining the data theft process:
- Version 2.0.4 targets base environment files and readme documents while disguising itself as a harmless function.
- Version 2.0.5 shifts focus to steal specific agent documentation and readme files.
- Version 2.0.6 acts aggressively by quietly searching the entire installation folder for all environment file variants.
- Version 2.0.7 reverts to earlier theft patterns but runs completely silently by suppressing all system logs.
- The dependent package “portalapp” version 1.0.0 is also affected by this supply chain compromise.
According to Socket research, developers who have installed any unscoped version of the tanstack package should immediately review their systems for unauthorized access.
Any credentials, API keys, or passwords stored in local environment files at the time of installation must be considered compromised and rotated immediately.
Removing the malicious package is not enough, as the data exfiltration occurs the exact moment the installation process begins.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
