CrowdSec Reports Private GitHub Repository Exposure Following TanStack Supply Chain Attack

On September 18, 2026, CrowdSec announced that an unauthorized actor gained access to approximately 170 private GitHub repositories. The intrusion occurred on May 22, 2026, and exploited the fact that a former employee's GitHub access remained active following their departure from the company. CrowdSec attributes the initial compromise to the May 2026 supply chain attack targeting TanStack npm packages. Malicious versions of these packages were distributed and, according to CrowdSec, stole credentials from the employee's laptop. The saved credentials likely included or provided access to GitHub tokens, enabling the attacker to copy the private repositories without additional authentication barriers. CrowdSec has not disclosed the specific proprietary code or data contained within the 170 repositories, but the exposure of private source code represents a significant intellectual property and supply chain risk. The company has stated it is investigating the incident and has likely revoked the former employee's access. The full impact, including any potential for further malicious activity or downstream supply chain effects, is not yet fully determined.