CrowdSec Confirms Breach: TanStack Supply-Chain Attack Exposed 170 Private GitHub Repos
George antony 
CrowdSec published a detailed post-incident report confirming that an actor linked to the TanStack npm supply-chain compromise exfiltrated roughly 170 of its private GitHub repositories, months before the theft surfaced publicly on a criminal forum.
The breach highlights the risks of trusting third-party packages and dependencies in software projects. Organizations should review affected repositories, rotate exposed credentials, and closely monitor their GitHub environments for suspicious activity.
CrowdSec confirmed a TanStack supply-chain attack that exposed access to around 170 private GitHub repositories. The incident involved compromised software dependencies being used to gain unauthorized access to development resources.
TanStack Supply-Chain Attack
The root cause traces back to May 11, 2026, when threat actor TeamPCP (tracked as UNC6780) backdoored 42 packages in the widely used TanStack npm repository with credential-stealing malware dubbed “Shai Hulud.” According to CrowdSec’s timeline, the campaign compromised a former employee’s machine.
Because the departing staffer’s GitHub organization access hadn’t been revoked yet, an attacker used his still-valid session between 05:52 and 06:01 UTC on May 22 to clone the private codebase from an IP address in Toronto.
CrowdSec only learned of the theft on September 16, 2026, when the archive appeared on a criminal forum and was flagged by French breach-monitoring outlet Fuites Info, a four-month gap between compromise and disclosure.
CrowdSec’s internal investigation initially stalled: the OAuth token used to pull the repositories no longer existed by the time the leak was discovered, and it left no footprint in the company’s own audit logs, a known limitation since GitHub only retains detailed git-activity logs for a rolling seven-day window on non-enterprise plans.
The turning point came when GitHub’s support team traced the token’s full lifecycle and matched a fetch event timestamped 2026-05-22 05:52:32 UTC to the departed employee’s dormant account, confirming the TanStack connection CrowdSec had suspected.
CrowdSec insists no infrastructure, databases, or its crowdsourced “Consensus Algorithm” blocklist were altered; only source code was taken, including 130-plus public repos and private ones covering the SaaS console, data-science scripts, and automation tooling.
The company says credential hygiene mostly held: the one live secret exposed was a narrowly scoped AWS SNS token, which was probed on August 17, 2026, but couldn’t be escalated.
More sensitive were 83 data-science team email addresses and, notably, the names, emails, and investment details of 51 potential investors from a 2020 fundraising round, which CrowdSec says it will disclose to regulators and affected individuals.
“This incident is a reminder that supply-chain attacks don’t respect org charts; an ex-employee’s laptop became the weakest link months after they’d already left,” a threat-intelligence analyst might note. “
The real lesson isn’t that CrowdSec failed at security hygiene; it’s that offboarding and endpoint monitoring need to extend to the exact moment access is truly dead, not just administratively revoked.”
CrowdSec says it compressed forensics, credential rotation, and public disclosure into roughly 48 hours after learning of the leak, and aims to shrink that to under 24 hours next time.
Post-incident, the company has rolled out endpoint detection (EDR) across developer machines a control it lacked during the original compromise specifically to catch malicious npm packages and extensions before they harvest tokens.
The episode underscores a growing pattern where npm and open-source supply-chain attacks serve as the initial foothold for downstream breaches at security vendors themselves, reinforcing why organizations must treat departing-employee access revocation and continuous credential auditing as non-negotiable, time-critical controls rather than routine paperwork.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
