Malicious Tanstack Package Uses Postinstall Script to Steal Developer Environment Files

A malicious npm package impersonating the widely trusted TanStack project was discovered on April 29, 2026, silently stealing developer environment files the moment it was installed. The attacker registered the unscoped “tanstack” package name on npm, dressed it up as a legitimate video player SDK called “TanStackPlayer,” and embedded a credential-harvesting script inside it that […]

The post Malicious Tanstack Package Uses Postinstall Script to Steal Developer Environment Files appeared first on Cyber Security News.