CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

A malicious supply chain attack targeting TanStack's npm packages allowed an attacker to steal GitHub tokens from a former employee's laptop, granting unauthorized access to approximately 170 of CrowdSec's private repositories. The core failure was twofold: a compromised third-party dependency silently harvested credentials, and offboarding processes failed to revoke the former employee's access tokens before the breach occurred. Stolen data included source code, user information, and investor data — demonstrating that supply chain compromises can cascade far beyond their initial entry point. This incident highlights how a single unrotated credential from a departed employee can expose an entire organization's codebase.