CrowdSec Confirms Source Code Stolen in Supply Chain Attack
CrowdSec confirmed attackers stole source code from roughly 300 GitHub repositories via the May 2026 TanStack supply chain attack; no customer data affected.
CrowdSec said roughly 300 GitHub repositories, including about 170 private ones holding SaaS console, AWS routine, connector, and automation code, were compromised with source code stolen. The breach likely stemmed from the May 2026 TanStack supply chain attack, in which TeamPCP published 84 malicious artifacts across 42 packages, compromising an API key. No customer credentials or data were leaked, and the company rotated all potentially affected tokens and credentials shortly after the incident.
- About 300 repositories compromised, including roughly 170 private ones with SaaS, AWS, connector code.
- Linked to May 2026 TanStack attack: TeamPCP published 84 malicious artifacts across 42 packages.
- No customer credentials or data leaked; all potentially affected tokens and credentials rotated.
- Company says stolen code cannot be used out of context and has since evolved.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1528 Steal Application Access TokenT1213.003 Code Repositories
- Products
- CrowdSec Security Engine
- Victims
- CrowdSec
- Organizations
- CrowdSec
- Countries
- France
From the original article
2 min read at securityweek.com
The cybersecurity firm believes the data breach was the result of the May 2026 TanStack supply chain attack. The post CrowdSec Confirms Source Code Stolen in Supply Chain Attack appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.