TanStack npm attack exposed 170 CrowdSec code repositories

The TanStack npm attack has been linked by CrowdSec to the copying of about 170 of its private GitHub repositories. In a report published on September 18, the French security company said the code was taken on May 22 through the GitHub account of an employee who had just left the business, and that the material appeared on an online forum on September 16.

CrowdSec is a security company whose open source Security Engine watches for attacks on servers. People who share what it detects receive a shared blocklist of malicious IP addresses. The event CrowdSec points to began on May 11, when, according to TanStack's advisory, 84 malicious versions of 42 TanStack npm packages were published. npm is a large public library of ready-made pieces of software that developers download and build into their own products, which is why a single compromise there can reach many companies at once. CrowdSec describes the event as a supply chain attack, meaning an attack that reaches a company through software it trusts rather than directly. It is tracked as CVE-2026-45321, and installing one of the affected versions ran code that stole credentials from the machine, including GitHub tokens, SSH keys (the digital keys used to log in to servers without typing a password) and cloud credentials.

CrowdSec says the copy was made 11 days after the malicious packages were published, using a GitHub OAuth token, an access key issued so an application can act on a person's behalf, taken from the former employee's account. The company had left his GitHub access in place so that he could finish some work. It removed his account from its GitHub organization on May 25, three days after the copy and months before it learned that the code had leaked. His other access had already been withdrawn, which CrowdSec says explains why it saw nothing suspicious in its AWS systems. The token left no trace in the GitHub logs the company could check, and it no longer existed by the time the leak was discovered. According to CrowdSec, GitHub support then traced the token's history and confirmed the company's suspicion that TanStack was the source. CrowdSec did not say which malicious package reached the former employee's laptop or when, and its report does not contain GitHub's own findings. It says its developers' machines were checked and came back clean.

The same campaign reached other organisations. Mistral AI said a developer device was involved in its case, and OpenAI said two employee devices were affected, with unauthorized access to a limited set of its internal code repositories.

The leaked material came from CrowdSec's private repositories rather than from the public Security Engine. According to the company, it includes the web console, data science scripts and models, automation scripts, and the consensus algorithm that decides which addresses are added to the blocklists. CrowdSec says the code is almost four months old and has changed a lot since. The leak also revealed the thresholds the consensus algorithm works with, such as how many detections are required before an address is added to a blocklist. Those numbers had not been public before. As far as the company knows, the blocklist still cannot be poisoned, meaning tricked into blocking a harmless address. It says an attacker would need tens of detections from tens of trusted engines across tens of separate networks, at great cost, and it adds that it can change the thresholds, as it often does.

On the credential side, CrowdSec says the only usable one in the leaked code was for AWS's SNS notification service, and that it could only publish messages to a single topic. Someone tried to use it on August 17, a month before the code was posted, but got no further. The other tokens had already been rotated (replaced) or could not be used from the internet, as far as the company knows. Personal data was exposed too. CrowdSec says it has about 150,000 users, and that its data science team had kept the 83 exposed email addresses to study how people used the product; the company says it will contact those users. The details of 51 potential investors from 2020 came from a system that CrowdSec says was never meant to be public. The company says it will report the leak to the investors and to the authorities, and CEO Philippe Humeau wrote to the investors in the report that "for this I personally apologize." CrowdSec rotated the exposed credentials on September 16 and 17. It did not require endpoint protection software, the tools that watch a laptop for malicious activity, on developers' machines at the time, but it now runs such software on the laptops of staff who work with its code or systems. Neither the report nor its first statement asks users to take any action.

The September 18 report differs from the statement CrowdSec published a day earlier. In that first statement the company said "No client data, login/password, name, organization, or anything else was leaked," and that the impact was limited to the company itself. It also named the TanStack compromise as the very likely source, saying a component used inside CrowdSec in May appeared to have been backdoored in order to steal an API key that could read the private code. The September 18 report says none of the malicious TanStack versions were found in CrowdSec's code, and points instead to the former employee's account. It also lists the investors' names, which the first statement said had not leaked, along with the 83 users' email addresses.

For website owners and IT teams, the practical point in CrowdSec's account is access that outlives the job. An account left open for a departing colleague, plus a token quietly taken from a laptop by a package installed more than a week earlier, together opened a door nobody was watching. Stolen login details that are used later and silently are a familiar route into websites and hosting accounts as well, which is why reviewing who can reach your systems, from which device, and for how long, is worth doing. Teams that want help looking at how access, laptops and source code are handled can turn to AEU-I, which provides security-first IT, infrastructure and consulting.