[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgBHpvgfdYJ0YgXz4mMfUlAyY5bYw5B2vnsrvhVBeL4U":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"e4717926-7802-4bc3-afbb-5717c1f4c47d","CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories","crowdsec-says-tanstack-npm-attack-led-to-copy-of-170-private-github-repositories-47bdb8","An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May's supply chain attack on TanStack, in which malicious versions of TanStack's npm packages stole credentials from","An attacker gained access to approximately 170 of CrowdSec's private GitHub repositories by exploiting a former employee's compromised laptop. The compromise stemmed from a supply chain attack on TanStack's npm packages, which stole credentials, including GitHub tokens. The stolen code, which also contained user and investor data, was posted online. CrowdSec stated that its core infrastructure and databases were not accessed, and no code was altered.","CrowdSec private GitHub repos copied after former employee's laptop compromised via npm attack.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcrowdsec-says-tanstack-npm-attack-led.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEg1oastBaXn1Z-Cqbx-BPWZb2oSsgDseV8bReFs787OUvmfsQxJppvU6Fq_uUY_yrCdz1Z4xuevbNRdG88X9lnejn0NUF2RILOB8VxTm8lGXQ6VpZ1hPPqfmC4U86Ci2iYpIqpjy_3H3rCxJe6_9AKm0U9vgO6GHGrDHaKSdzCcFfgpUolbZvSB6VPbCC8\u002Fs1600\u002Fcrowdsec.jpg","2026-09-19T07:14:54+00:00","2026-09-19T08:00:13.757217+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"npm","product",{"name":21,"type":22},"TanStack","vendor",{"name":24,"type":19},"GitHub",{"name":26,"type":22},"CrowdSec",{"name":28,"type":19},"AWS",{"name":30,"type":22},"Mistral AI","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"cve","CVE-2026-45321","Malicious TanStack npm package compromise",[21,26,30],{"controls":61,"vendors":137},[62,91,119],{"slug":63,"name":64,"problem":65,"products":66},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":92,"name":93,"problem":94,"products":95},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[96,104,111],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":105,"vendor_name":24,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[124,132],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":133,"product_name":134,"url":135,"description":136},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":155},"compromised-npm-package-leads-to-theft-of-170-private-github-repos","Compromised npm Package Leads to Theft of 170 Private GitHub Repos","A malicious supply chain attack targeting TanStack's npm packages allowed an attacker to steal GitHub tokens from a former employee's laptop, granting unauthorized access to approximately 170 of CrowdSec's private repositories. The core failure was twofold: a compromised third-party dependency silently harvested credentials, and offboarding processes failed to revoke the former employee's access tokens before the breach occurred. Stolen data included source code, user information, and investor data — demonstrating that supply chain compromises can cascade far beyond their initial entry point. This incident highlights how a single unrotated credential from a departed employee can expose an entire organization's codebase.",[143,144,145,146,147,148,149,150,151,152,153,154],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 5: Account Management","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST AC-2: Account Management","NIST AC-3: Access Enforcement","NIST SI-7: Software, Firmware, and Information Integrity","NIST IR-6: Incident Reporting","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach","ITIL: Change and Release Management (dependency vetting)","SLSA Framework: Supply-chain Levels for Software Artifacts",{}]