CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
CrowdSec says the TanStack npm supply chain attack let an attacker copy 170 private GitHub repos via a former employee's retained account.
On May 22 an attacker used a GitHub OAuth token from a former CrowdSec employee whose organization access had been kept active, copying about 170 private repositories containing the web console, data science models, and blocklist consensus algorithm. CrowdSec attributes the access to CVE-2026-45321, the May 11 publication of 84 malicious versions of 42 TanStack npm packages that stole GitHub tokens, SSH keys, and cloud credentials from developer machines. The leaked archive also exposed email addresses of 83 users and names, emails, and investment context of 51 potential investors from 2020. The same campaign affected Mistral AI and OpenAI, and the only usable credential found in the leak, an AWS SNS publish token, saw an attempted misuse on August 17.
- Former employee's GitHub account with retained access copied ~170 private repos May 22
- CVE-2026-45321: 84 malicious versions of 42 TanStack npm packages stole credentials
- Leak exposed source code, 83 user emails, and 51 investors' details
- Mistral AI and OpenAI devices were also hit by the same npm campaign
- Only usable credential was a scoped AWS SNS publish token, misused August 17
- CVEs
- CVE-2026-45321
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1552.004 Private KeysT1528 Steal Application Access TokenT1078 Valid AccountsT1213.003 Data from Code Repositories
- Victims
- CrowdSecMistral AIOpenAI
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-45321 | Supply chain compromise: credential-stealing code in 42 @tanstack/* npm packages | 9.6 | 3% | KEVRansomwarePoC ×2 | KEV |
From the original article
4 min read at thehackernews.com
An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May's supply chain attack on TanStack, in which malicious versions of TanStack's npm packages stole credentials from
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.