Critical TanStack Supply Chain Attack Exposes 170 CrowdSec GitHub Repos

Key Takeaways

• CrowdSec experienced a data breach involving approximately 170 private GitHub repositories.
• The incident stemmed from a former employee’s compromised account, linked to the TanStack npm supply chain attack (CVE-2026-45321).
• Attackers exfiltrated source code on May 22, but the theft remained undetected until September 16 when the data surfaced on a cybercrime forum.
• While no production systems were compromised, sensitive data including user email addresses and investor information was exposed.

CrowdSec Suffers Breach After TanStack Supply Chain Attack Exposes GitHub Repositories

Cybersecurity firm CrowdSec has confirmed that attackers successfully exfiltrated approximately 170 of its private GitHub repositories. The breach originated from the compromise of a former employee’s account, which was ensnared in the widespread TanStack npm supply chain attack that occurred in May.

The unauthorized data extraction, which took place on May 22, went unnoticed for nearly four months. It was only on September 16, when the stolen source code began appearing on a cybercrime forum, that CrowdSec became aware of the incident. This protracted delay highlights how a tainted dependency can have long-lasting consequences, extending far beyond the initial infection window and compromising developer identities.

The TanStack Supply Chain Compromise

The root cause of the CrowdSec breach is identified as CVE-2026-45321, which refers to the broader compromise of the TanStack Router and Start ecosystem. On May 11, a threat actor leveraged a series of vulnerabilities, including an insecure pull_request_target workflow, GitHub Actions cache poisoning, and the runtime extraction of an OpenID Connect token. This sophisticated chain of attacks enabled the publication of 84 malicious releases across 42 distinct @tanstack packages.

Each of these compromised packages contained an obfuscated payload designed to execute during installation. This malware was engineered to harvest a range of sensitive credentials from affected systems, including GitHub and npm tokens, various cloud credentials, Kubernetes and Vault secrets, and SSH keys.

CrowdSec’s Exposure and Delayed Discovery

CrowdSec disclosed that the compromised account belonged to a developer who had recently departed the company but still maintained GitHub access to finalize outstanding tasks. Between 05:52 and 06:01 UTC on May 22, an intruder utilized an OAuth token associated with this account to clone the private repositories. The activity was traced to an IP address located in Toronto, Canada.

Although CrowdSec removed the former employee from its GitHub organization on May 25, just three days after the unauthorized downloads, the company remained unaware that the repositories had already been copied. The clues to the breach were eventually found within the leaked archive itself. A .git/config file contained a GitHub credential prefixed with gho_, indicating an OAuth access token. Timestamps and commit history further pinpointed the theft to May 22.

Subsequent assistance from GitHub support proved crucial. They were able to reconstruct the lifecycle of the expired token and provide activity logs spanning a two-hour window. This information allowed CrowdSec to definitively link the repository cloning activity to the former employee’s account and the broader TanStack compromise.

Scope of the Breach and Exposed Data

The stolen material encompassed a wide array of CrowdSec’s intellectual property, including its SaaS console, data-science scripts and models, various deployment and automation tools, and the consensus algorithm used to populate its malicious IP address blocklists. While over 130 repositories in the archive were already publicly accessible, the presence of private data was concerning.

CrowdSec confirmed that its production infrastructure and databases remained unaccessed, no source code or CI/CD pipelines were modified, and the exposed account only performed Git fetch operations. However, the leak did contain sensitive information. The company identified email addresses belonging to 83 users, representing less than 0.05% of its 150,000 user base. Additionally, names, email addresses, and investment context for 51 prospective investors from 2020 were exposed.

An active AWS credential, used for sending SNS notifications, was also part of the leak. However, this role was strictly limited to publishing to a single topic. CrowdSec observed an attempt to test this credential on August 17 using GetCallerIdentity and ListTopics, but found no evidence of further unauthorized access.

Mitigation and Lessons Learned

In response to the incident, CrowdSec initiated a series of security measures. These included rotating all potentially compromised credentials, conducting thorough reviews of cloud and GitHub activity, notifying affected individuals, and enhancing monitoring capabilities. The company also enforced endpoint detection and response (EDR) solutions on all developer workstations, augmenting existing controls such such as two-factor authentication, hardware security keys, secure secret storage, automated code scanning, package-age restrictions, and robust onboarding and offboarding procedures.

This security incident underscores two critical lessons for the cybersecurity community. Firstly, even robust multi-factor authentication (MFA) cannot prevent malware from stealing an already authorized OAuth token directly from a developer’s endpoint. Secondly, delayed discovery can lead to the loss of crucial forensic evidence. GitHub’s enterprise audit log retains Git events for only seven days unless organizations implement external streaming for long-term storage, highlighting the necessity of independent, persistent logging for effective source-code investigations.

The company says its rapidly changing codebase, combined with scoped privileges and a distributed consensus design, helps limit the overall risk. Nevertheless, the breach serves as a stark reminder that modern supply chain attacks increasingly target identities and trust relationships with the same intensity as they do the software itself.

What You Should Do

• Assume Compromise: If your organization installed any of the affected TanStack versions, treat the host system as compromised.
• Rebuild from Trusted Image: Rebuild any compromised systems from a trusted, clean image.
• Rotate Credentials: Immediately rotate all credentials that could have been accessed by the malicious package installer. This includes GitHub/npm tokens, cloud credentials, and any other secrets.
• Inspect Logs: Thoroughly inspect cloud and source-control logs for any signs of unauthorized activity.
• Remove Stale Access: Implement stringent offboarding procedures to immediately revoke all access for departing employees.
• Restrict OAuth Applications: Review and restrict OAuth applications to only those absolutely necessary.
• Disable Unnecessary Scripts: Disable unnecessary npm lifecycle scripts to reduce the attack surface.
• Pin Dependencies: Pin dependencies to specific, known-good versions to prevent automatic updates to potentially malicious versions.
• Monitor Developer Endpoints: Enhance monitoring on developer endpoints for signs of credential theft and suspicious activity.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.