TanStack Supply Chain Attack
In a recent cybersecurity incident, CrowdSec revealed that approximately 170 private GitHub repositories were accessed by attackers. This breach occurred following the compromise of a former employee’s account through a supply chain attack on TanStack’s npm packages in May.
The breach, initially undetected, came to light when the stolen source code surfaced on a cybercrime forum on September 16. This incident highlights the persistent threat posed by compromised dependencies, which can exploit developer identities long after the initial infection.
Details of the Security Breach
The root of the attack lies in the CVE-2026-45321 vulnerability affecting TanStack’s Router and Start ecosystem. On May 11, attackers exploited a series of vulnerabilities, including an insecure pull_request_target workflow and GitHub Actions cache poisoning. This allowed them to release 84 malicious versions of 42 @tanstack packages.
These packages contained an obfuscated payload that activated during installation to collect sensitive information such as GitHub and npm tokens, cloud credentials, and SSH keys from affected systems.
Impact on CrowdSec
The compromised GitHub account belonged to a developer who had recently left CrowdSec but still had access to finish ongoing work. On May 22, between 05:52 and 06:01 UTC, the attackers used an OAuth token linked to this account to clone the private repositories from an IP address in Toronto, Canada.
CrowdSec removed the former employee from its GitHub organization on May 25, unaware of the unauthorized access. Clues found in the leaked archive, such as a .git/config file containing a GitHub credential, helped CrowdSec trace the breach back to the TanStack vulnerability.
Response and Recommendations
The stolen data included CrowdSec’s SaaS console, data-science scripts, and other sensitive tools. However, CrowdSec confirmed that no production infrastructure or databases were accessed, and the exposed account was used only for Git fetch operations.
In response, CrowdSec rotated credentials, reviewed cloud and GitHub activities, and increased monitoring. They also implemented additional security measures, such as endpoint detection and response on developer workstations, and enforced stricter controls.
This incident underscores critical lessons for organizations. First, multifactor authentication alone cannot prevent the theft of OAuth tokens from compromised endpoints. Second, delayed detection can lead to the loss of crucial evidence, as GitHub retains audit logs for a limited time.
Organizations should consider affected systems compromised, rotate credentials, and enhance monitoring of cloud and source-control logs. It’s crucial to remove outdated access when employees leave and restrict OAuth applications to mitigate risks.
The breach serves as a stark reminder of the evolving nature of supply chain attacks, which increasingly target identities and trust relationships within software ecosystems.
