TanStack Supply Chain Attack Lets Hackers Steal 170 Private CrowdSec GitHub Repositories
Attackers used an OAuth token stolen in the TanStack npm supply chain attack to clone 170 private CrowdSec GitHub repositories, later leaked on a forum.
CrowdSec disclosed that attackers copied about 170 private GitHub repositories using the OAuth token of a former employee whose account was compromised in the TanStack npm supply chain attack (CVE-2026-45321). The compromise chained an unsafe pull_request_target workflow, GitHub Actions cache poisoning, and OIDC token extraction to publish 84 malicious releases across 42 @tanstack packages that harvested GitHub, npm, cloud, Kubernetes, Vault, and SSH credentials. The repositories were cloned from a Toronto IP on May 22 and the theft surfaced on September 16 when source code appeared on a cybercrime forum. Exposed data included emails of 83 users (<0.05% of 150,000), details on 51 potential investors, and an AWS SNS credential that was tested once.
- 84 malicious releases across 42 @tanstack packages harvested GitHub, npm, cloud, Kubernetes, Vault, and SSH credentials.
- Ex-employee's OAuth token was used on May 22 to clone repositories from a Toronto IP address.
- Leak exposed emails of 83 users and 2020 investor details; a scoped AWS SNS credential was tested.
- GitHub audit logs retain Git events only seven days, prompting calls for external log streaming.
- Production infrastructure and databases were not accessed; no CI/CD pipeline was modified.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-45321 | Supply chain compromise: credential-stealing code in 42 @tanstack/* npm packages CVE-2026-45321 is a supply chain compromise in which 84 malicious versions across 42 @tanstack/* npm packages (including @tanstack/react-router, @tanstack/react-start, @tanstack/history, and related router/start packages) were published to the npm registry on 2026-05-11 between roughly 19:20 and 19:26 UTC, authenticated through TanStack's legitimate GitHub Actions OIDC trusted-publisher binding. The attacker chained three known weakness classes — a pull_request_target 'Pwn Request' misconfiguration, GitHub Actions cache poisoning across the fork-to-base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — allowing publication under a trusted identity without modifying the publish workflow. Each affected package received exactly two malicious versions carrying credential-stealing malware, so developers, CI pipelines, or downstream builds that installed them could have npm, GitHub, and cloud credentials extracted; related reporting (FBI, StepSecurity) links the campaign to stolen cloud credentials and a self-spreading 'Mini Shai-Hulud' worm that also hit packages in other ecosystems such as Mistral AI and Guardrails AI. Exposure is limited to consumers who installed the two malicious versions published per package during the exposure window; other users of these widely deployed libraries were not affected by the malicious publishes. Exploitation is confirmed in the wild: the issue was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-27 with known ransomware use, and EPSS estimates a 2.3% probability of exploitation in the next 30 days (83rd percentile). Do: Audit lockfiles and CI logs for the affected @tanstack/* packages' versions published during the 2026-05-11 ~19:20-19:26 UTC window; if found, reinstall from clean versions per the TanStack postmortem (tanstack.com/blog/npm-supply-chain-compromise-postmortem) and rotate exposed credentials (npm tokens, GitHub PATs/secrets, cloud keys), treating any cached CI artifacts as suspect. Apply mitigations per vendor instructions and CISA BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable, and remediate the underlying CI weaknesses (pull_request_target handling, Actions cache hygiene, and OIDC token handling) to prevent recurrence. | 9.6 | 2% | KEV ransomware PoC ×2 |
| large~100,000+ downstream installs/CI runs (estimate) |
Full article673 words · extracted from cybersecuritynews.com · click to collapse
CrowdSec has disclosed that attackers copied about 170 private GitHub repositories after a former employee’s account was compromised through May’s TanStack npm supply chain attack.
The May 22 theft remained undetected until stolen source code appeared on a cybercrime forum on September 16, showing how a poisoned dependency can outlive its infection window and undermine developer identities.
The incident traces to CVE-2026-45321, the compromise of TanStack’s Router and Start ecosystem. On May 11, the threat actor chained an unsafe pull_request_target workflow, GitHub Actions cache poisoning, and runtime extraction of an OpenID Connect token to publish 84 malicious releases across 42 @tanstack packages.
TanStack Supply Chain Attack
Each package executed an obfuscated install-time payload designed to harvest GitHub and npm tokens, cloud credentials, Kubernetes and Vault secrets, and SSH keys from systems.
CrowdSec said the compromised account belonged to a developer who recently left but retained GitHub access to finish work. Between 05:52 and 06:01 UTC on May 22, the intruder used an OAuth token associated with that account to clone the private repositories from an IP address in Toronto, Canada.
CrowdSec removed the former employee from its GitHub organization on May 25, three days after the unauthorized downloads, unaware the repositories had already been copied.
Clues inside the leaked archive proved decisive. A .git/config file contained a GitHub credential beginning with gho_, the prefix assigned to OAuth access tokens, while timestamps and the latest commits narrowed the theft to May 22.
GitHub support later reconstructed the expired token’s lifecycle and supplied activity records for the two-hour period, helping CrowdSec connect the cloning activity to the former employee and the TanStack compromise.
The stolen material included CrowdSec’s SaaS console, data-science scripts and models, deployment and automation tools, and its consensus algorithm for adding malicious IP addresses to blocklists.
More than 130 repositories in the archive were already public. CrowdSec said its production infrastructure and databases were not accessed, no source code or CI/CD pipeline was modified, and the exposed account performed only Git fetch operations.
The leak contained sensitive information. CrowdSec identified email addresses belonging to 83 users, representing less than 0.05% of its 150,000 users, along with names, email addresses, and investment context for 51 potential investors from 2020.
An active AWS credential for sending SNS notifications was exposed, but the role was restricted to publishing to one topic. Someone tested it on August 17 using GetCallerIdentity and ListTopics, with no evidence of further access.
CrowdSec rotated credentials, reviewed cloud and GitHub activity, notified affected people, and increased monitoring. It enforced endpoint detection and response on developer workstations, supplementing existing controls such as two-factor authentication, hardware keys, secret storage, automated code scanning, package-age restrictions, and onboarding and offboarding procedures.
This security episode highlights two lessons. First, multifactor authentication cannot stop malware from stealing an already authorized OAuth token from a developer endpoint.
Second, delayed discovery can erase evidence: GitHub’s enterprise audit log retains Git events for only seven days unless organizations stream them externally, making independent, long-term logging essential for source-code investigations.github+1
Organizations that installed affected versions should treat the host as compromised, rebuild it from a trusted image, rotate every credential reachable by the package installer, and inspect cloud and source-control logs for unauthorized activity.
They should also remove stale access immediately when employees leave, restrict OAuth applications, disable unnecessary npm lifecycle scripts, pin dependencies, and monitor developer endpoints for credential theft.
The company says its rapidly changing codebase, scoped privileges, and distributed consensus design limit that risk, but the breach remains a stark reminder that modern supply chain attacks target identities and trust relationships as aggressively as software itself.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Guru Baranhttps://cybersecuritynews.com
Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/tanstack-supply-chain-attack/