CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
CrowdSec says the TanStack npm supply chain attack let an attacker copy 170 private GitHub repos via a former employee's retained account.
On May 22 an attacker used a GitHub OAuth token from a former CrowdSec employee whose organization access had been kept active, copying about 170 private repositories containing the web console, data science models, and blocklist consensus algorithm. CrowdSec attributes the access to CVE-2026-45321, the May 11 publication of 84 malicious versions of 42 TanStack npm packages that stole GitHub tokens, SSH keys, and cloud credentials from developer machines. The leaked archive also exposed email addresses of 83 users and names, emails, and investment context of 51 potential investors from 2020. The same campaign affected Mistral AI and OpenAI, and the only usable credential found in the leak, an AWS SNS publish token, saw an attempted misuse on August 17.
- Former employee's GitHub account with retained access copied ~170 private repos May 22
- CVE-2026-45321: 84 malicious versions of 42 TanStack npm packages stole credentials
- Leak exposed source code, 83 user emails, and 51 investors' details
- Mistral AI and OpenAI devices were also hit by the same npm campaign
- Only usable credential was a scoped AWS SNS publish token, misused August 17
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-45321 | Supply chain compromise: credential-stealing code in 42 @tanstack/* npm packages CVE-2026-45321 is a supply chain compromise in which 84 malicious versions across 42 @tanstack/* npm packages (including @tanstack/react-router, @tanstack/react-start, @tanstack/history, and related router/start packages) were published to the npm registry on 2026-05-11 between roughly 19:20 and 19:26 UTC, authenticated through TanStack's legitimate GitHub Actions OIDC trusted-publisher binding. The attacker chained three known weakness classes — a pull_request_target 'Pwn Request' misconfiguration, GitHub Actions cache poisoning across the fork-to-base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — allowing publication under a trusted identity without modifying the publish workflow. Each affected package received exactly two malicious versions carrying credential-stealing malware, so developers, CI pipelines, or downstream builds that installed them could have npm, GitHub, and cloud credentials extracted; related reporting (FBI, StepSecurity) links the campaign to stolen cloud credentials and a self-spreading 'Mini Shai-Hulud' worm that also hit packages in other ecosystems such as Mistral AI and Guardrails AI. Exposure is limited to consumers who installed the two malicious versions published per package during the exposure window; other users of these widely deployed libraries were not affected by the malicious publishes. Exploitation is confirmed in the wild: the issue was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-27 with known ransomware use, and EPSS estimates a 2.3% probability of exploitation in the next 30 days (83rd percentile). Do: Audit lockfiles and CI logs for the affected @tanstack/* packages' versions published during the 2026-05-11 ~19:20-19:26 UTC window; if found, reinstall from clean versions per the TanStack postmortem (tanstack.com/blog/npm-supply-chain-compromise-postmortem) and rotate exposed credentials (npm tokens, GitHub PATs/secrets, cloud keys), treating any cached CI artifacts as suspect. Apply mitigations per vendor instructions and CISA BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable, and remediate the underlying CI weaknesses (pull_request_target handling, Actions cache hygiene, and OIDC token handling) to prevent recurrence. | 9.6 | 2% | KEV ransomware PoC ×2 |
| large~100,000+ downstream installs/CI runs (estimate) |
Full article896 words · extracted from thehackernews.com · click to collapse
An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18.
The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May's supply chain attack on TanStack, in which malicious versions of TanStack's npm packages stole credentials from developers' machines.
The code appeared on an online forum on September 16. Along with the source code, it contained the email addresses of 83 CrowdSec users and the names, email addresses, and investment context of 51 potential investors from 2020, the company said.
CrowdSec says the account was used only to copy code, that its infrastructure and databases were not accessed, and that no code was changed.
How the Code Was Taken
On May 11, 84 malicious versions of 42 TanStack npm packages were published. The compromise is tracked as CVE-2026-45321. Installing one of those versions ran code that stole credentials from the machine, including GitHub tokens, SSH keys, and cloud credentials, according to TanStack's advisory.
The company says the copy was made 11 days later with a GitHub OAuth token from the former employee's account. The company had kept his access so he could finish some work.
CrowdSec removed his account from its GitHub organization on May 25, three days after the copy and months before it learned of the leak. His other access had already been removed, which the company says explains why it saw no suspicious activity in its AWS systems.
The token left no trace in the GitHub logs it could check and no longer existed when it learned of the leak. It says GitHub support then traced the token's history and confirmed its suspicion that TanStack was the source.
CrowdSec did not say which malicious package reached the former employee's laptop or when, and its report does not include GitHub's own findings. It says its developers' machines were checked and came back clean.
The same attack also reached other companies. Mistral AI said a developer device was involved in its case, and OpenAI said two employee devices were affected, with unauthorized access to a limited set of its internal code repositories.
What the Archive Held
CrowdSec's open-source Security Engine detects attacks on servers, and users who share their detections receive a shared blocklist of malicious IP addresses. The leaked code comes from the company's private repositories, not this public engine.
According to the company, the code includes its web console, data science scripts and models, automation scripts, and the consensus algorithm that determines which IP addresses are added to the blocklists.
It says the code is almost four months old and has changed a lot since.
CrowdSec says the leak also revealed the thresholds the consensus algorithm uses, such as how many detections it requires before adding an IP address to the blocklist. These had not been public before.
As far as it knows, the blocklist still cannot be poisoned, meaning tricked into blocking a harmless IP address. It says an attacker would need tens of detections from tens of trusted engines across tens of separate networks, at great cost. CrowdSec also says it can change the thresholds, as it often does.
According to the company, the only usable credential in the leak was for AWS's SNS notification service, and it could only publish messages to one topic. Someone tried to use it on August 17, a month before the code was posted, but got no further. Other tokens in the code had already been rotated or could not be used from the internet, as far as the company knows.
CrowdSec says it has about 150,000 users. Its data science team kept the 83 exposed email addresses to study how people used the product, and the company says it will contact those users.
The investors' details came from a 2020 system that CrowdSec says was never meant to be public. The company says it will report the leak to the investors and to the authorities. CEO Philippe Humeau wrote to the investors in the report that "for this I personally apologize."
The affected company rotated the exposed credentials on September 16 and 17. It did not require endpoint protection software on developers' machines at the time, but it now runs such software on the laptops of staff who work with its code or systems.
Neither CrowdSec's report nor its first statement asks users to take any action.
How CrowdSec's Account Changed
CrowdSec's September 18 report differs from its first statement, published a day earlier. In that statement, CrowdSec said "No client data, login/password, name, organization, or anything else was leaked," and that the impact was limited to the company.
The first statement also named the TanStack compromise as the very likely source of the leak. It said a component used inside CrowdSec in May appeared to have been backdoored to steal an API key that could read the private code.
The September 18 report says none of the malicious TanStack versions were found in CrowdSec's code, and points instead to the former employee's account. It also lists the investors' names, which the first statement said had not leaked, along with the 83 users' email addresses.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/crowdsec-says-tanstack-npm-attack-led.html