Cybersecurity company CrowdSec has disclosed that an attacker copied approximately 170 private GitHub repositories after compromising credentials belonging to a former employee, with the incident ultimately traced back to the major TanStack npm supply chain attack disclosed earlier this year.
The repositories were copied on May 22, but CrowdSec only became aware of the breach months later after the stolen source code appeared on an online forum on September 16. The exposed material included private company code as well as limited information belonging to users and potential investors. (The Hacker News)
Compromised npm Packages Stole Developer CredentialsThe incident began with the TanStack supply chain attack on May 11, when attackers published 84 malicious versions across 42 npm packages.
Tracked as CVE-2026-45321, the compromise caused infected packages to execute credential-stealing code on developers’ computers. The malware targeted sensitive information including GitHub tokens, SSH keys, and cloud credentials. (The Hacker News)
CrowdSec believes a laptop belonging to an employee who was leaving the company was compromised during this campaign.
Although most of the employee’s access had already been removed, CrowdSec intentionally kept his GitHub access active so he could complete remaining work. Attackers were subsequently able to use a stolen GitHub OAuth token associated with the account.
On May 22, that token was used to copy around 170 private repositories. CrowdSec removed the former employee from its GitHub organization three days later, unaware that the repositories had already been accessed. (The Hacker News)
Internal Source Code ExposedCrowdSec says attackers copied code related to several important internal systems, including its web console, automation scripts, data science models, and the consensus algorithm used to determine which malicious IP addresses should be included in its shared blocklists.
The leaked code also exposed previously private thresholds used by that consensus system, such as the number of detections required before an IP address can be added to a blocklist.
However, CrowdSec says the stolen source code was nearly four months old when it became public and that the relevant systems have changed significantly since May.
The company also maintains that attackers cannot realistically use the leaked information to poison its blocklists. Doing so would require coordinated detections from numerous trusted CrowdSec engines operating across independent networks. (The Hacker News)
User and Investor Information Was Also LeakedThe incident was not limited entirely to source code.
CrowdSec discovered that the archive contained 83 user email addresses, as well as names, email addresses, and investment-related information belonging to 51 potential investors dating from 2020.
The company says no production databases or broader customer infrastructure were accessed, and attackers did not modify its source code.
CrowdSec also found one potentially usable AWS SNS credential in the leaked material. Someone attempted to use it in August, but its permissions were limited to publishing messages to a single notification topic and the attempt did not progress further. Other exposed credentials had either already been rotated or could not be accessed from the internet. (The Hacker News)
A Small Offboarding Gap Had Major ConsequencesThe breach illustrates how supply chain attacks can combine with identity-management weaknesses to produce consequences months after the original compromise.
The malicious npm packages did not need to directly attack CrowdSec’s servers. They only needed to steal a developer credential with sufficient access.
Keeping the departing employee’s GitHub account active then provided attackers with the opportunity they needed.
CrowdSec says it has since rotated affected credentials and strengthened endpoint security. At the time of the incident, endpoint protection software was not mandatory on developer machines. It is now deployed on laptops belonging to employees who interact with company code or infrastructure. (The Hacker News)
The TanStack compromise also affected other technology companies. Mistral AI reported involvement of a developer device, while OpenAI said two employee devices were affected and attackers gained unauthorized access to a limited number of internal code repositories. (The Hacker News)
The CrowdSec incident demonstrates why software supply chain security cannot stop at scanning dependencies. Developer endpoints, OAuth tokens, repository permissions, credential rotation, and employee offboarding are all part of the same security boundary.
A compromised dependency may provide the initial opportunity, but a single credential that remains valid can transform that compromise into a much larger breach.