CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May's supply chain attack on TanStack, in which malicious versions of TanStack's npm packages stole credentials from

Report facts: CrowdSec disclosed that an attacker copied about 170 of its private GitHub repositories on May 22 by abusing the GitHub account of a recently departed employee whose access had not been revoked. The company states the employee’s laptop was compromised during the TanStack npm supply chain attack, where malicious package versions were used to steal credentials. RealGround analysis: This incident illustrates how third-party package compromises can cascade into source code exposure when combined with weak offboarding and credential hygiene, making AI and software supply chains vulnerable even without a direct breach of production systems. Organizations should harden dependency management, enforce rapid access revocation for departing staff, and continuously monitor developer machines and repositories for anomalous access tied to compromised credentials.