Reported by 5 outlets

Timeline

1. original reporting

   CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories https:// pawb.social/post/50287756

   thehackernews.com · 24d ago · September 19th, 2026

   CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories https:// pawb.social/post/50287756

   via Mastodon https://thehackernews.com/2026/09/crowdsec-says-tanstack-npm-attack-led.html

2. update from beyondmachines.net

   CrowdSec Source Code Leak Linked to TanStack npm Supply Chain Attack CrowdSec suffered a source code leak after attackers exploited a TanSta

   beyondmachines.net · 23d ago · September 20th, 2026

   CrowdSec Source Code Leak Linked to TanStack npm Supply Chain Attack CrowdSec suffered a source code leak after attackers exploited a TanSta

   via Mastodon https://beyondmachines.net/event_details/crowdsec-source-code-leak-linked-to-tanstack-npm-supply-chain-attack-6-u-i-d-6/gD2P6Ple2L

3. update from securebulletin.com

   TanStack Supply-Chain Breach Exposes 170 Private CrowdSec Repositories # CyberSecurity https:// securebulletin.com/tanstack-su pply-chain-br

   securebulletin.com · 23d ago · September 20th, 2026

   TanStack Supply-Chain Breach Exposes 170 Private CrowdSec Repositories # CyberSecurity https:// securebulletin.com/tanstack-su pply-chain-br

   via Mastodon https://securebulletin.com/tanstack-supply-chain-breach-exposes-170-private-crowdsec-repositories/

4. update from gbhackers.com

   Hackers Exploit TanStack Supply Chain Attack to Steal 170 Private CrowdSec Repositories

   gbhackers.com · 22d ago · September 21st, 2026

   Threat actors linked to the TanStack npm supply chain compromise allegedly used a stolen GitHub OAuth token to clone about 170 private CrowdSec repositories, exposing source code, limited contact information, and a restricted AWS notification credential. CrowdSec stated that the compromise originated from a former employee’s account, which remained in the company’s GitHub organization for […] The post Hackers Exploit TanStack Supply Chain Attack to Steal 170 Private CrowdSec Repositories appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

5. update from cyberpress.org

   TanStack NPM Supply Chain Attack Exposes 170 Private CrowdSec GitHub Repositories

   cyberpress.org · 22d ago · September 21st, 2026

   CrowdSec has disclosed that a May 2026 compromise tied to the TanStack npm supply-chain incident enabled attackers to clone roughly 170 private GitHub repositories, exposing internal source code and limited sensitive contact data. The company said the intrusion was traced to a former employee’s GitHub OAuth token, which attackers allegedly obtained through the broader TanStack compromise attributed to TeamPCP, also tracked as UNC6780. CrowdSec emphasized that its production infrastructure, databases, CI/CD pipelines , and open-source code were not altered or directly compromised. TanStack NPM Supply Chain Attack TeamPCP compromised the TanStack npm ecosystem on May 11, backdooring 42 packages with the credential-harvesting malware known as Shai Hulud. The malicious campaign targeted developer environments for GitHub tokens, cloud credentials, SSH keys, and other secrets. Between 05:52 UTC and 06:01 UTC on May 22, an attacker used a GitHub OAuth token associated with a recently departed CrowdSec employee to download the contents of approximately 170 private repositories. Git metadata indicated the activity originated from an IP address geolocated to Toronto, Canada, with a system timezone consistent with UTC-4. Data Leak Claim (Source: crowdsec) The attacker later published an archive of CrowdSec repositories on a breach forum on September 16. The archive included more than 130 public repositories, along with private code, SaaS console components, data-science scripts, automat