What Happened
Open-source security vendor CrowdSec has confirmed that attackers stole source code from its internal repositories in a breach the company traces back to the May 2026 TanStack supply chain attack. CrowdSec disclosed that roughly 300 repositories were touched, including about 170 private ones, and that the exfiltrated material included SaaS console source code, AWS cloud automation routines, connectors, and other internal tooling.
How the Breach Occurred
The root cause was not a direct compromise of CrowdSec's own infrastructure. Instead, it traces back to the TanStack npm ecosystem attack from May 2026, in which the threat actor tracked as TeamPCP published 84 malicious artifacts across 42 TanStack packages. CrowdSec had a TanStack package in its build pipeline during the window the malicious versions were live, and the malware used that foothold to steal an API key. That stolen key gave the attackers direct access to CrowdSec's private codebase.
The TanStack campaign has now been linked to breaches at multiple companies beyond its original targets — CrowdSec joins a growing list of organizations still surfacing collateral damage from that attack months after it was first disclosed.
What Was Exposed
CrowdSec says the stolen material spans both private and public repository code, specifically:
- SaaS console source code
- AWS cloud automation routines
- Connectors and integration code
- Internal build and deployment tooling
The company was explicit about what was not found: "Our team quickly hunted for any token, credential, or sensitive leak that could enable lateral movement but found none so far." CrowdSec says no customer credentials or customer data were leaked, and that the impact is limited to its own internal organization.
CrowdSec's Response
CrowdSec says it immediately rotated all tokens and credentials that could plausibly have been exposed during the incident window, and argues that the leaked source code alone is of limited practical use to an attacker — deploying or abusing it would still require access to CrowdSec's proprietary data stores and internal tooling that were not part of the theft.
Why This Matters
CrowdSec is a security vendor whose products are widely used to detect and block exactly this kind of automated, credential-driven attack — which makes this disclosure notable on its own terms. More broadly, this incident is another data point in a pattern CosmicBytez Labs has tracked through 2026: a single poisoned npm campaign (TanStack, in this case) continuing to generate downstream breach disclosures for months as more affected organizations complete their investigations. Any team that had a TanStack package in its dependency tree during the malicious-version window should treat credential rotation as mandatory, not optional, even if no direct compromise indicators have surfaced yet.