CrowdSec Discloses TanStack npm Supply Chain Attack (CVE-2026-45321) Exposed 170 Private GitHub Repositories
Attackers used a former employee's OAuth token, stolen via the TanStack npm supply chain attack (CVE-2026-45321), to copy ~170 private CrowdSec GitHub repositories on May 22; the stolen source code surfaced on a cybercrime forum on September 16.
CrowdSec disclosed that the TanStack npm supply chain attack (CVE-2026-45321) led to the theft of about 170 of its private GitHub repositories. On May 11, 84 malicious versions of 42 @tanstack npm packages were published; the compromise chained an unsafe pull_request_target workflow, GitHub Actions cache poisoning, and OIDC token extraction to harvest GitHub, npm, cloud, Kubernetes, Vault, and SSH credentials from developer machines. On May 22, an attacker used the GitHub OAuth token of a former CrowdSec employee whose organization access had been kept active to clone the repositories from a Toronto IP address. The copied repos contained the web console, data science models, and the blocklist consensus algorithm. The theft surfaced on September 16 when the source code appeared on a cybercrime forum. The leaked archive also exposed email addresses of 83 users (under 0.05% of roughly 150,000 users) and the names, emails, and investment context of 51 potential investors from 2020. CrowdSec said the only usable credential found in the leak was a scoped AWS SNS publish token, which was tested once in an attempted misuse on August 17. The same npm campaign also affected Mistral AI and OpenAI devices. CrowdSec stated that production infrastructure and databases were not accessed and no CI/CD pipeline was modified, and noted that GitHub audit logs retain Git events for only seven days, prompting calls for external log streaming.
- CVE-2026-45321: 84 malicious versions of 42 @tanstack npm packages were published on May 11, harvesting GitHub, npm, cloud, Kubernetes, Vault, and SSH credentials.
- The attack chain involved an unsafe pull_request_target workflow, GitHub Actions cache poisoning, and OIDC token extraction.
- On May 22, the former employee's OAuth token (organization access retained) was used to clone ~170 private repositories from a Toronto IP address.
- The stolen repositories contained the web console, data science models, and the blocklist consensus algorithm.
- The theft surfaced on September 16 when the source code appeared on a cybercrime forum.
- The leak exposed emails of 83 users (<0.05% of ~150,000) and details (names, emails, investment context) of 51 potential investors from 2020.
- The only usable credential in the leak was a scoped AWS SNS publish token, tested once in an attempted misuse on August 17.
- The same TanStack npm campaign also affected Mistral AI and OpenAI devices.
Coverage timelineoldest first · each row is one article
- · 17h agoCrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
The Hacker News· 74
CrowdSec says the TanStack npm supply chain attack let an attacker copy 170 private GitHub repos via a former employee's retained account.
- · 13h agoTanStack Supply Chain Attack Lets Hackers Steal 170 Private CrowdSec GitHub Repositories
Cyber Security News· 70
Attackers used an OAuth token stolen in the TanStack npm supply chain attack to clone 170 private CrowdSec GitHub repositories, later leaked on a forum.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-45321 | Supply chain compromise: credential-stealing code in 42 @tanstack/* npm packages CVE-2026-45321 is a supply chain compromise in which 84 malicious versions across 42 @tanstack/* npm packages (including @tanstack/react-router, @tanstack/react-start, @tanstack/history, and related router/start packages) were published to the npm registry on 2026-05-11 between roughly 19:20 and 19:26 UTC, authenticated through TanStack's legitimate GitHub Actions OIDC trusted-publisher binding. The attacker chained three known weakness classes — a pull_request_target 'Pwn Request' misconfiguration, GitHub Actions cache poisoning across the fork-to-base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — allowing publication under a trusted identity without modifying the publish workflow. Each affected package received exactly two malicious versions carrying credential-stealing malware, so developers, CI pipelines, or downstream builds that installed them could have npm, GitHub, and cloud credentials extracted; related reporting (FBI, StepSecurity) links the campaign to stolen cloud credentials and a self-spreading 'Mini Shai-Hulud' worm that also hit packages in other ecosystems such as Mistral AI and Guardrails AI. Exposure is limited to consumers who installed the two malicious versions published per package during the exposure window; other users of these widely deployed libraries were not affected by the malicious publishes. Exploitation is confirmed in the wild: the issue was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-27 with known ransomware use, and EPSS estimates a 2.3% probability of exploitation in the next 30 days (83rd percentile). Do: Audit lockfiles and CI logs for the affected @tanstack/* packages' versions published during the 2026-05-11 ~19:20-19:26 UTC window; if found, reinstall from clean versions per the TanStack postmortem (tanstack.com/blog/npm-supply-chain-compromise-postmortem) and rotate exposed credentials (npm tokens, GitHub PATs/secrets, cloud keys), treating any cached CI artifacts as suspect. Apply mitigations per vendor instructions and CISA BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable, and remediate the underlying CI weaknesses (pull_request_target handling, Actions cache hygiene, and OIDC token handling) to prevent recurrence. | 9.6 | 2% | KEV ransomware PoC ×2 |
| large~100,000+ downstream installs/CI runs (estimate) |