
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
@hyperdx/browser
Advanced tools
npm install @hyperdx/browser
import HyperDX from '@hyperdx/browser';
HyperDX.init({
apiKey: '<YOUR_API_KEY_HERE>',
service: 'my-frontend-app',
tracePropagationTargets: [/api.myapp.domain/i], // Set to link traces from frontend to backend requests
consoleCapture: true, // Capture console logs (default false)
advancedNetworkCapture: true, // Capture full HTTP request/response headers and bodies (default false)
});
Attaching user information will allow you to search/filter sessions and events in HyperDX. This can be called at any point during the client session. The current client session and all events sent after the call will be associated with the user information.
userEmail, userName, and teamName will populate the sessions UI with the corresponding values, but can be omitted. Any other additional values can be specified and used to search for events.
HyperDX.setGlobalAttributes({
userEmail: user.email,
userName: user.name,
teamName: user.team.name,
// Other custom properties...
});
To explicitly track a specific application event (ex. sign up, submission, etc.), you can call the addAction function with an event name and optional event metadata.
Example:
HyperDX.addAction('Form-Completed', {
formId: 'signup-form',
formName: 'Signup Form',
formType: 'signup',
});
To enable or disable network capture dynamically, simply invoke the enableNetworkCapture or disableAdvancedNetworkCapture function as needed.
HyperDX.enableNetworkCapture();
FAQs
```bash npm install @hyperdx/browser ```
The npm package @hyperdx/browser receives a total of 33,846 weekly downloads. As such, @hyperdx/browser popularity was classified as popular.
We found that @hyperdx/browser demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.