TanStack Supply Chain Attack Lets Hackers Steal 170 Private CrowdSec GitHub Repositories
Attackers used an OAuth token stolen in the TanStack npm supply chain attack to clone 170 private CrowdSec GitHub repositories, later leaked on a forum.
CrowdSec disclosed that attackers copied about 170 private GitHub repositories using the OAuth token of a former employee whose account was compromised in the TanStack npm supply chain attack (CVE-2026-45321). The compromise chained an unsafe pull_request_target workflow, GitHub Actions cache poisoning, and OIDC token extraction to publish 84 malicious releases across 42 @tanstack packages that harvested GitHub, npm, cloud, Kubernetes, Vault, and SSH credentials. The repositories were cloned from a Toronto IP on May 22 and the theft surfaced on September 16 when source code appeared on a cybercrime forum. Exposed data included emails of 83 users (<0.05% of 150,000), details on 51 potential investors, and an AWS SNS credential that was tested once.
- 84 malicious releases across 42 @tanstack packages harvested GitHub, npm, cloud, Kubernetes, Vault, and SSH credentials.
- Ex-employee's OAuth token was used on May 22 to clone repositories from a Toronto IP address.
- Leak exposed emails of 83 users and 2020 investor details; a scoped AWS SNS credential was tested.
- GitHub audit logs retain Git events only seven days, prompting calls for external log streaming.
- Production infrastructure and databases were not accessed; no CI/CD pipeline was modified.
- CVEs
- CVE-2026-45321
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1528 Steal Application Access TokenT1078 Valid AccountsT1213.003 Code Repositories
- Products
- TanStack RouterTanStack Start
- Victims
- CrowdSec
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-45321 | Supply chain compromise: credential-stealing code in 42 @tanstack/* npm packages | 9.6 | 3% | KEVRansomwarePoC ×2 | KEV |
From the original article
3 min read at cybersecuritynews.com
CrowdSec has disclosed that attackers copied about 170 private GitHub repositories after a former employee’s account was compromised through May’s TanStack npm supply chain attack. The May 22 theft remained undetected until stolen source code appeared on a cybercrime forum on September 16, showing how a poisoned dependency can outlive its infection window and undermine […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.