CrowdSec Private GitHub Repos Copied in TanStack npm Supply Chain Attack
An attacker accessed about 170 private CrowdSec GitHub repositories using stolen credentials from the May TanStack npm supply chain attack, exploiting a compromised former employee account.
Why it matters
The incident underscores the operational risks posed by supply chain compromises and the critical importance of timely revocation of access for former employees to prevent unauthorized repository access.
SOC impact
Security teams should focus on identifying potential exposure to supply chain attacks, monitoring for unusual access to private repositories, and reviewing access controls for former employees to detect and mitigate similar breaches.
Recommended actions
- Identify and audit all private GitHub repositories potentially accessed
- Review access permissions related to former employees
- Monitor developer account activity for anomalies
- Assess impact of the TanStack npm supply chain compromise
- Correlate telemetry for suspicious repository downloads or cloning
Executive Summary
In September 2026, CrowdSec disclosed that approximately 170 of its private GitHub repositories were copied by an attacker leveraging credentials stolen during the May TanStack npm package supply chain attack. The attacker gained access through a compromised account belonging to a former employee whose laptop was infected as part of the initial incident. This case highlights the cascading consequences of supply chain attacks, especially when access is not promptly revoked for personnel no longer with the organization. Operationally, organizations face increased risk not only from the initial compromise but also from residual access that enables attackers to reach sensitive development assets.
SOC Impact
Security teams should focus on identifying potential exposure to supply chain attacks, monitoring for unusual access to private repositories, and reviewing access controls for former employees to detect and mitigate similar breaches.
Access and Repository Exposure Validation
- Identify and audit all private GitHub repositories potentially accessed
- Review access permissions related to former employees
- Monitor developer account activity for anomalies
- Assess impact of the TanStack npm supply chain compromise
- Correlate telemetry for suspicious repository downloads or cloning
Why It Matters
The incident underscores the operational risks posed by supply chain compromises and the critical importance of timely revocation of access for former employees to prevent unauthorized repository access.