CrowdSec Breach: 170 Private Repositories Compromised via TanStack npm Attack

• •170 private GitHub repositories stolen from CrowdSec via a compromised OAuth token.
• •Attack linked to the TanStack npm supply chain attack, exploiting malicious npm packages.
• •No infrastructure compromise reported; sensitive user data also exposed.

On May 22, 2026, threat actors exploited a compromised OAuth token from a former CrowdSec employee's machine to steal 170 private GitHub repositories. The breach was linked to the TanStack npm supply chain attack, where malicious npm packages were used to extract credentials. CrowdSec discovered the leak on September 16, 2026, when source code appeared on an underground forum. The stolen data included source code and sensitive user information, although CrowdSec confirmed that its infrastructure remained secure. The OAuth token used for access was not traceable in GitHub logs, complicating the investigation. CrowdSec had retained the former employee's GitHub access for ongoing work, which contributed to the breach. The company removed the compromised account shortly after the incident but was unaware of the breach until months later. CrowdSec has since conducted an investigation and reported its findings publicly.