Digital Warfare Podcast Daily Brief May 12, 2026

The Digital Warfare Podcast · May 12, 2026 · 4m

Summary

Researchers discovered a malicious npm package named tanstack impersonating the legitimate @tanstack ecosystem in a supply chain attack targeting developers. The package used hidden postinstall scripts to automatically search for sensitive environment files such as .env and .env.local, then exfiltrated the contents to attacker-controlled infrastructure. The incident highlights the growing risk of brand-squatting and dependency confusion attacks across open-source ecosystems.

Key Takeaways

• Attackers registered the unscoped “tanstack” package to impersonate the trusted @tanstack…