CrowdSec Confirms Source Code Stolen in Supply Chain Attack
CrowdSec confirms source code stolen in supply chain attack via TanStack compromise.
French cybersecurity firm CrowdSec has confirmed that its GitHub repositories were compromised, resulting in the theft of source code from approximately 300 repositories, including 170 private ones. The company believes this breach was a consequence of the May 2026 TanStack supply chain attack, where malware likely exploited an API key to access CrowdSec's private codebase. CrowdSec stated that no customer data was leaked and the stolen code is unlikely to pose an immediate threat outside of its own environment.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CrowdSec?
Get an email when a new story names CrowdSec, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCrowdSec's GitHub repositories were compromised as a downstream consequence of the TanStack supply chain attack, where malware likely harvested an API key that granted access to approximately 300 repositories, including 170 private ones. This incident illustrates how a single compromised third-party dependency can cascade into a serious breach for organizations that trust it — even security-focused companies are not immune. The exposure of proprietary source code, while not immediately weaponizable externally, can enable adversaries to identify hidden vulnerabilities, hardcoded secrets, or internal architecture details for future attacks. This underscores the critical need to treat third-party integrations as potential attack vectors and to apply the principle of least privilege to all API credentials and tokens.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.