TanStack Supply Chain Attack Compromised CrowdSec GitHub Repositories
CrowdSec disclosed that an attacker accessed approximately 170 private GitHub repositories by exploiting credentials stolen during the TanStack npm supply chain attack.
CrowdSec, a cybersecurity firm, has revealed that an attacker gained access to around 170 of its private GitHub repositories on May 22. The breach was facilitated through the compromised account of a former employee whose laptop was infected during a supply chain attack targeting the popular TanStack npm packages.
The incident came to light when the stolen code, along with sensitive information including the email addresses of 83 CrowdSec users and details of 51 potential investors from 2020, appeared on an online forum on September 16. CrowdSec emphasized that the attacker only copied code, did not alter any files, and did not access its core infrastructure or databases.
The root cause traces back to May 11, when 84 malicious versions of 42 TanStack npm packages were published, a compromise tracked as CVE-2026-45321. When developers installed these tainted packages, malicious code executed on their machines, stealing credentials such as GitHub tokens, SSH keys, and cloud credentials. CrowdSec confirmed that the former employee's GitHub OAuth token, compromised through this attack, was used to access its repositories approximately 11 days later.
CrowdSec had maintained the former employee's GitHub access to allow for the completion of pending work. The company subsequently revoked the account on May 25, before it was aware of the data exfiltration. While other access for the former employee had been removed earlier, the lingering GitHub token proved to be the vector for the code theft. CrowdSec noted that the token left no discernible trace in their logs and was no longer active when the breach was discovered.
GitHub's support team assisted CrowdSec in tracing the token's history, confirming the link to the TanStack compromise. While CrowdSec stated that none of the malicious TanStack packages were found directly within its own codebase, the compromised credentials from the former employee's machine were the direct enabler of the repository access. The company also confirmed that its developers' machines were scanned and found to be clean.
This attack is part of a broader pattern of exploitation stemming from the TanStack compromise, affecting other organizations as well. Mistral AI and OpenAI have also reported instances where developer devices were compromised, leading to unauthorized access to internal code repositories. These incidents underscore the far-reaching consequences of supply chain attacks that compromise development tools.
The leaked code from CrowdSec's private repositories includes its web console, data science scripts, automation tools, and the consensus algorithm used for its security engine's blocklists. While the code is reportedly four months old and has since been updated, it does reveal previously non-public details about the thresholds used in its consensus algorithm. CrowdSec stated that the blocklist remains difficult to poison and that it regularly updates these thresholds.
CrowdSec has taken steps to mitigate the impact, including rotating exposed credentials and implementing endpoint protection software on developer laptops. The company plans to notify the affected users and investors and has apologized for the incident. This incident highlights the critical need for robust credential management and timely revocation of access, especially in the wake of widespread supply chain compromises.
This new report provides further details on the TanStack supply chain attack's impact, revealing that the compromised former CrowdSec employee's GitHub account was used to clone approximately 170 private CrowdSec repositories. The stolen data included sensitive source code, investor information, and AWS credentials, with the breach only being discovered when leaked code appeared on a cybercrime forum. The investigation highlighted the critical role of long-term logging for reconstructing events, as GitHub's enterprise audit logs only retain Git events for seven days.
CrowdSec has now confirmed that the supply chain attack, which occurred in May 2026 and is believed to be linked to the TanStack compromise, resulted in the exfiltration of source code from approximately 300 GitHub repositories. Both public and private code were stolen, including proprietary code for their SaaS console and AWS routines. While the company asserts that no customer data was compromised and the stolen code cannot be used out of context, they are actively monitoring for any malicious activity.
This latest report identifies the threat actor responsible for the CrowdSec GitHub data breach as the Shai-Hulud group. The article further clarifies that the compromised OAuth token was obtained via the TanStack npm supply chain attack, specifically from a former employee's machine, adding crucial attribution and a more detailed vector to the initial disclosure.
Two GitHub Actions repositories, actions-cool/issues-helper and actions-cool/maintain-one-comment, which were previously compromised as part of the Mini Shai-Hulud campaign in May 2026, have been re-enabled by GitHub. Crucially, these repositories were not cleaned of the malicious code, meaning that any workflow referencing them by version tag resumed executing the malware upon their re-enablement on September 16, 2026. This incident highlights a significant supply chain risk where previously contained threats can be reactivated without new exploits or infrastructure, emphasizing the importance of SHA pinning over mutable tags.