CrowdSec has disclosed that attackers copied about 170 private GitHub repositories after a former employee’s account was compromised through May’s TanStack npm supply chain attack.
The May 22 theft remained undetected until stolen source code appeared on a cybercrime forum on September 16, showing how a poisoned dependency can outlive its infection window and undermine developer identities.
The incident traces to CVE-2026-45321, the compromise of TanStack’s Router and Start ecosystem. On May 11, the threat actor chained an unsafe pull_request_target workflow, GitHub Actions cache poisoning, and runtime extraction of an OpenID Connect token to publish 84 malicious releases across 42 @tanstack packages.
TanStack Supply Chain Attack
Each package executed an obfuscated install-time payload designed to harvest GitHub and npm tokens, cloud credentials, Kubernetes and Vault secrets, and SSH keys from systems.
CrowdSec said the compromised account belonged to a developer who recently left but retained GitHub access to finish work. Between 05:52 and 06:01 UTC on May 22, the intruder used an OAuth token associated with that account to clone the private repositories from an IP address in Toronto, Canada.
CrowdSec removed the former employee from its GitHub organization on May 25, three days after the unauthorized downloads, unaware the repositories had already been copied.
Clues inside the leaked archive proved decisive. A .git/config file contained a GitHub credential beginning with gho_, the prefix assigned to OAuth access tokens, while timestamps and the latest commits narrowed the theft to May 22.
GitHub support later reconstructed the expired token’s lifecycle and supplied activity records for the two-hour period, helping CrowdSec connect the cloning activity to the former employee and the TanStack compromise.
The stolen material included CrowdSec’s SaaS console, data-science scripts and models, deployment and automation tools, and its consensus algorithm for adding malicious IP addresses to blocklists.
More than 130 repositories in the archive were already public. CrowdSec said its production infrastructure and databases were not accessed, no source code or CI/CD pipeline was modified, and the exposed account performed only Git fetch operations.
The leak contained sensitive information. CrowdSec identified email addresses belonging to 83 users, representing less than 0.05% of its 150,000 users, along with names, email addresses, and investment context for 51 potential investors from 2020.
An active AWS credential for sending SNS notifications was exposed, but the role was restricted to publishing to one topic. Someone tested it on August 17 using GetCallerIdentity and ListTopics, with no evidence of further access.
CrowdSec rotated credentials, reviewed cloud and GitHub activity, notified affected people, and increased monitoring. It enforced endpoint detection and response on developer workstations, supplementing existing controls such as two-factor authentication, hardware keys, secret storage, automated code scanning, package-age restrictions, and onboarding and offboarding procedures.
This security episode highlights two lessons. First, multifactor authentication cannot stop malware from stealing an already authorized OAuth token from a developer endpoint.
Second, delayed discovery can erase evidence: GitHub’s enterprise audit log retains Git events for only seven days unless organizations stream them externally, making independent, long-term logging essential for source-code investigations.github+1
Organizations that installed affected versions should treat the host as compromised, rebuild it from a trusted image, rotate every credential reachable by the package installer, and inspect cloud and source-control logs for unauthorized activity.
They should also remove stale access immediately when employees leave, restrict OAuth applications, disable unnecessary npm lifecycle scripts, pin dependencies, and monitor developer endpoints for credential theft.
The company says its rapidly changing codebase, scoped privileges, and distributed consensus design limit that risk, but the breach remains a stark reminder that modern supply chain attacks target identities and trust relationships as aggressively as software itself.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
