CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

A Token That Should Have Been Revoked

French cybersecurity firm CrowdSec disclosed on September 18, 2026 that an attacker copied roughly 170 of its private GitHub repositories back on May 22, 2026 — using a GitHub OAuth token belonging to a former employee whose access had never been revoked. CrowdSec said it kept the ex-employee's GitHub access open "so he could finish some work," while his other systems access had already been removed. That partial offboarding is why the intrusion left no trace in the logs CrowdSec was actively monitoring.

The Root Compromise: TanStack's May npm Attack

The former employee's laptop was infected through the TanStack npm supply chain attack, tracked as CVE-2026-45321. On May 11, 2026, attackers published malicious versions of 42 TanStack npm packages containing code that stole credentials directly from developer machines — GitHub tokens, SSH keys, and cloud credentials among them. CrowdSec has not specified which malicious package version reached the employee's device or exactly when.

Eleven days later, on May 22, the attacker used the stolen token to copy the 170 repositories. CrowdSec removed the former employee's GitHub access on May 25 — three days after the theft, but with no indication at the time that anything had happened.

What Was Taken

The stolen archive, roughly four months old at the time of discovery, included:

• 170 private GitHub repositories — source code for CrowdSec's web console, internal data science scripts, automation tooling, and the consensus algorithm that determines when an IP address gets added to CrowdSec's crowdsourced blocklist
• 83 user email addresses pulled from a product research database
• 51 potential investor records from a 2020-era system, including names and investment context

Timeline

Response and Broader Fallout

CrowdSec has since rotated all exposed credentials, deployed endpoint protection software on developer machines with access to sensitive code, and begun notifying the users whose emails were exposed, with outreach to affected investors and regulators planned. CEO Philippe Humeau personally apologized to investors in the company's disclosure.

CrowdSec is not the only organization caught up in the TanStack compromise: Mistral AI reported a compromised developer device, and OpenAI disclosed that two employee devices were affected, giving attackers access to a limited set of its internal code repositories.

Sources

• The Hacker News — CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories