TanStack npm Supply Chain Compromise - Network Exfil, C2 & Worm Enumeration

Montaser Ismail@M0nt3x

•updated Aug 31, 2026•4•0•6

Detects network connections to known suspicious infrastructure, including specific domains associated with Session, catbox.moe, or targeted npm registry and GitHub API queries initiated by common command-line utilities. This behavior often suggests adversary communication, data staging, or potential tool/malware delivery.