CrowdSec discloses source-code leak traced to TanStack npm supply-chain attack
A stolen GitHub token from a former employee's compromised laptop let an attacker copy 170 private CrowdSec repositories, the security firm says.
What to know
- The leak traces to May's TanStack npm supply-chain attack (CVE-2026-45321), which stole a GitHub token from a former CrowdSec employee's laptop.
- CrowdSec kept the ex-employee's GitHub access open to finish work, letting the stolen token be used to copy ~170 private repos before the account was revoked days later.
- CrowdSec says its infrastructure, databases, and blocklist system were not accessed; exposed personal data was limited to 83 users and 51 potential investors, and the one usable leaked credential (an AWS SNS token) had narrow scope.
- CrowdSec's detailed public post-mortem drew notable praise from security practitioners for its transparency.
CrowdSec French cybersecurity companyCrowdSec CEO Author of the company's post-mortem blog postTanStack Open-source npm package maintainerMistral AI Company also affected by the TanStack attackOpenAI Company also affected by the TanStack attack
How it unfolded 2 developments, newest first · click a bar or a number to jump posts
-
2
Security community praises CrowdSec's transparency
Security practitioners circulate CrowdSec's post-mortem, commending its level of detail and candor compared with typical breach disclosures.
“Really wish every cybersecurity outfit (and every org for that matter) was as forthcoming and detailed (and competent) as Philippe and team.”
— hrbrmstr -
H
*Great* write-up by @ CrowdSec on the supply chain attack that ultimately led to their recent security incident. Really wish every cybersecurity outfit (and every org for that matter) was as forthcoming and detailed (and competent) as Philippe and team. https://www. crowdsec.net/blog/tanstack-sup ply-chain-attack-analysis
2 more of the top 3 · 3 posts in this stretch
-
B
CrowdSec Source Code Leak Linked to TanStack npm Supply Chain Attack CrowdSec suffered a source code leak after attackers exploited a TanStack npm supply chain vulnerability to steal a former employee's GitHub credentials. The breach exposed 170 private repositories and personal data for 134 users and investors. **** # cybersecurity # infosec #…
-
P
TanStack Supply Chain Attack Lets Hackers Steal 170 Private CrowdSec GitHub Repositories https:// packetstorm.news/news/view/436 65 # news
-
-
1
CrowdSec's CEO publishes a detailed post-mortem
CrowdSec's CEO publishes an extensive write-up covering the timeline, origin point, credential and data impact, and the team's reaction, arguing the real-world impact is smaller than the headline suggests.
“The reality looks fairly different 48 hours later. First, I was astonished by how comprehensive and genuinely benevolent our team, clients, partners, and providers were.”
— CrowdSec CEO -
S
A supply-chain attack became a # databreach . Malicious TanStack npm packages stole a GitHub token from an ex-CrowdSec employee whose access remained active. Attackers copied ~170 private repos and exposed data on 83 users and 51 potential investors: 👇 https:// thehackernews.com/2026/09/crow dsec-says-tanstack-npm-attack-led.html
-
-
background
CrowdSec confirms the breach and its scope — CrowdSec publicly confirms the leak, says its infrastructure and databases were not accessed and no code was altered, and details which data and credentials were exposed.
-
background
Stolen CrowdSec code surfaces on an online forum — The copied private repositories, containing source code plus emails of 83 users and personal details on 51 potential investors, appear posted publicly on an online forum.
-
background
Someone tries to use the leaked AWS token — A month before the code surfaces publicly, someone attempts to use the leaked AWS SNS notification token found in the copied code, but its narrow scope prevents any further access.
-
background
CrowdSec revokes former employee's GitHub access — Three days after the copy, and months before learning of the leak, CrowdSec removes the former employee's account from its GitHub organization, having already removed his other access.
-
background
Attacker copies ~170 CrowdSec private repos — Using a GitHub OAuth token stolen from a former CrowdSec employee's compromised laptop, an attacker copies about 170 of CrowdSec's private repositories; the employee's access had deliberately been left open to finish work.
-
background
Malicious TanStack npm packages published — 84 malicious versions of 42 TanStack npm packages are published, later tracked as CVE-2026-45321; installing them runs code that steals GitHub tokens, SSH keys and cloud credentials from developers' machines.