Malicious npm Packages Target SAP CAP and TanStack Developers

Multiple npm package incidents exposed developers and CI/CD pipelines to supply-chain risk, including suspicious SAP CAP-related packages and a malicious brand-squatting package impersonating TanStack. Socket reported that affected versions of mbt and several @cap-js/* packages introduced a new preinstall script that downloaded a platform-specific Bun archive from GitHub Releases, extracted it, and executed the binary during installation. The behavior was flagged as high risk because the packages had not previously depended on Bun, the installer reportedly followed HTTP redirects without validating the destination, and Windows execution used PowerShell with -ExecutionPolicy Bypass, creating an unexpected code-execution path in SAP development and deployment workflows.

In a separate but concurrent npm attack, the unscoped tanstack package was used to impersonate the legitimate @tanstack/* ecosystem and steal secrets from developer machines. Malicious versions 2.0.4 through 2.0.7, published by maintainer sh20raj, used postinstall scripts to exfiltrate .env and related files to an attacker-controlled Svix endpoint at api.svix.com, potentially exposing API keys, database credentials, and authentication tokens. TanStack maintainer Tanner Linsley said the package was not affiliated with the project, and researchers linked the releases to a coordinated campaign using shared infrastructure. Organizations were urged to remove affected packages, review lockfiles and CI/CD logs, block the rogue package, and rotate any credentials that may have been exposed.