Immediate breach summary
On September 18, 2026 CrowdSec disclosed that an ex-employee’s GitHub OAuth token was used on May 22 to clone roughly 170 of the company’s private repositories. The token had been harvested by a TanStack npm supply chain attack earlier that month, a campaign now tracked as CVE-2026-45321. The stolen archive contained the web console, data-science models, automation scripts and the consensus algorithm that drives its IP blocklist, as well as email addresses of 83 users and details of 51 investors.
How the TanStack npm supply chain attack worked
On May 11, 2026 threat actors published 84 malicious versions of 42 TanStack npm modules. Each package contained a post-install script that, when executed on a developer’s workstation, searched for credential files and environment variables. The script exfiltrated GitHub personal access tokens, SSH private keys and cloud API keys to a command-and-control endpoint. TanStack’s advisory linked the behavior to CVE-2026-45321, noting that the malicious code ran with the privileges of the installing user.
CrowdSec’s investigation confirmed that the former employee’s laptop had installed one of the compromised packages. The stolen OAuth token granted read-only access to the organization’s private repositories. Because the token was created before the employee’s departure, CrowdSec kept the account active to allow the individual to finish pending work, inadvertently providing a window for abuse.
Timeline of events
| Date | Event |
|---|---|
| May 11 | 84 malicious TanStack npm packages published (CVE-2026-45321). |
| May 22 | OAuth token used to clone ~170 private repos from CrowdSec’s GitHub org. |
| May 25 | CrowdSec removed the former employee’s account from the GitHub organization. |
| Sep 16 | Leaked archive posted on a public forum; CrowdSec rotated exposed credentials. |
| Sep 18 | Full breach report published by CrowdSec. |
The timeline shows a lag of more than three months between the credential theft and public disclosure, during which the stolen token left no trace in GitHub’s audit logs. GitHub support later reconstructed the token’s lifecycle and corroborated the TanStack npm supply chain attack as the source.
Scope of the leaked material
The archive did not contain production binaries or live database dumps, but it exposed:
- Web console source – UI code used by customers to view blocklists and alerts.
- Data-science scripts and models – Proprietary algorithms for anomaly detection and threat scoring.
- Automation scripts – Tooling that orchestrates blocklist updates across distributed sensors.
- Consensus algorithm code – Logic that determines how many independent detections are required before an IP is added to the blocklist.
- User and investor data – Email addresses of 83 active users and personal details of 51 investors from a 2020 CRM export.
Only a single AWS SNS credential was usable; it allowed publishing to a single topic and was attempted on August 17 without success. All other tokens were either already rotated or unusable from the internet.
Operational impact and remediation steps
CrowdSec reports that the copied code was up to four months old and has since undergone multiple revisions, reducing the immediate risk of replay attacks. However, exposure of consensus thresholds could aid adversaries attempting to poison the blocklist in the future. The company notes that blocklist poisoning requires tens of detections from trusted engines, but it will adjust thresholds as part of hardening.
Remediation actions taken by CrowdSec:
- Token revocation – All OAuth tokens associated with the former employee were revoked on September 16-17.
- Endpoint protection rollout – New EDR software is now mandatory on all developer laptops that interact with code repositories.
- Credential rotation – Exposed AWS SNS credentials and any other leaked secrets were rotated immediately.
- User notification – The 83 affected users will be contacted directly; the company will also inform the 51 investors and relevant authorities.
Recommendations for other organizations:
- Enforce least-privilege token scopes and set short expiration times for personal access tokens.
- Implement automated token revocation as part of employee off-boarding workflows.
- Deploy EDR on developer workstations to detect anomalous post-install scripts.
- Regularly audit npm dependency provenance using tools such as
npm auditand third-party SBOM generators. - Monitor GitHub audit logs for token creation and usage anomalies; enable GitHub’s token-usage alerts.
Wider supply-chain implications
The TanStack npm supply chain attack is not isolated. Mistral AI and OpenAI have both reported that developers’ machines were compromised by the same malicious npm payload, leading to limited unauthorized access to internal code bases. This pattern underscores a growing trend: npm supply-chain attacks are becoming a primary vector for credential theft, especially where developers install third-party packages without strict verification.
Security researchers warn that the npm ecosystem’s trust model—where a single compromised maintainer can affect millions of downstream projects—requires a shift toward signed packages and deterministic builds. npm introduced a “package signing” beta in early 2026, but adoption remains low, leaving many organizations vulnerable.
Regulatory perspective
European data-protection authorities consider the exposure of personal email addresses and investor data a personal data breach under GDPR Article 33. CrowdSec, headquartered in France, is likely to face a supervisory-authority notification deadline of 72 hours after becoming aware of the breach. The delayed public disclosure (over three months after the initial copy) may attract scrutiny, although the organization argues that the breach was only discovered when the archive surfaced publicly.
In the United States, the CISA has added CVE-2026-45321 to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch affected npm packages immediately. Organizations that rely on TanStack components should verify their lockfiles and consider npm audit fix --force to replace compromised versions.
What to watch next
- Further disclosures – Additional victims may emerge as investigators parse GitHub’s token-usage logs.
- Patch releases – TanStack is expected to publish signed, clean versions of the affected packages within the next week.
- Threat-actor attribution – While the supply-chain compromise has been linked to a known “npm-driven” threat group, attribution remains tentative pending forensic analysis.
- Policy shifts – Enterprises may accelerate adoption of software-bill-of-materials (SBOM) compliance and enforce stricter npm provenance checks.
The CrowdSec breach illustrates how a single supply-chain foothold can cascade into large-scale data exfiltration when internal access controls are lax. Organizations must treat developer-machine hygiene as a critical security boundary, not an afterthought.
For deeper guidance on securing npm supply chains, see the NIST recommendations at NIST and our internal best-practice guide at /threat-intelligence/npm-supply-chain.
Related coverage
- Google Gemini AI Model Breach: A Case Study
- npm supply chain attack RedC2 Deploys AI-Powered Linux Backdoor
- Orkes Conductor CVE-2026-58138: Critical Pre-Auth RCE Actively Exploited