Crowd Sec Says Tan Stack npm Attack Led to Copy of 170 Private GitHub Repositories
Summary: CrowdSec said on September 18 that an attacker copied about 170 of its private GitHub repositories on May 22 using the account of an employee who had just left, whose GitHub access the company had kept open so he could finish some work. CrowdSec attributes the credential theft to the May 11 TanStack npm supply chain attack, in which 84 malicious versions of 42 packages ran code that stole GitHub tokens, SSH keys, and cloud credentials, and the copied code surfaced on an online forum on September 16 along with the email addresses of 83 CrowdSec users and details on 51 potential investors from 2020.
What's compelling: The copy was made with a GitHub OAuth token from a departed employee's account that left no trace in the GitHub logs CrowdSec could check and no longer existed when it learned of the leak, so the exposure went unseen for nearly four months. The leaked code also revealed the previously non-public thresholds of the consensus algorithm that decides which IP addresses reach the blocklist, which CrowdSec says still cannot be poisoned because an attacker would need tens of detections from tens of trusted engines across tens of separate networks.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2026-45321
- Related
- CVE-2026-45321: Tan Stack Unspecified Vulnerability Known Exploited Vulnerabilities · May 27, 2026Kitesurf is now open source Cyber Risks · Nov 13, 2026