---
title: CrowdSec Source Code Stolen in TanStack Supply Chain Attack
description: CrowdSec confirms attackers took code from about 170 private GitHub repos, along with emails of 83 users and 51 prospective investors. Credentials rotated.
canonical_url: https://codekeeper.co/ticker/crowdsec-supply-chain-breach-github-repositories
---

# CrowdSec Source Code Stolen in TanStack Supply Chain Attack

CrowdSec confirms attackers took code from about 170 private GitHub repos, along with emails of 83 users and 51 prospective investors. Credentials rotated.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Sep 26, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrowdsec-supply-chain-breach-github-repositories%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrowdsec-supply-chain-breach-github-repositories%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrowdsec-supply-chain-breach-github-repositories%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrowdsec-supply-chain-breach-github-repositories%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrowdsec-supply-chain-breach-github-repositories%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrowdsec-supply-chain-breach-github-repositories%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

French cybersecurity firm CrowdSec confirmed that attackers copied roughly 170 of its private GitHub repositories in May 2026, a theft that only came to light when the archive appeared on a hacking forum on September 16. CrowdSec traced the breach to the May 11 TanStack supply chain attack, in which an attacker published 84 malicious versions across 42 npm packages. The malware compromised a recently departed developer still in CrowdSec's GitHub organization, whose OAuth token was used to clone the code on May 22. The private code covers CrowdSec's SaaS console, AWS cloud routines, connectors, and automations. The dump also held the email addresses of 83 users and the names, emails, and investment context of 51 prospective investors from 2020, which CrowdSec is reporting to them and the authorities. CrowdSec has rotated all exposed credentials. It says the code has little value outside its own environment, though it concedes full source access could speed up hunting for weaknesses. Source: [CrowdSec](https://www.crowdsec.net/blog/tanstack-supply-chain-attack-analysis)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrowdsec-supply-chain-breach-github-repositories%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrowdsec-supply-chain-breach-github-repositories%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrowdsec-supply-chain-breach-github-repositories%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrowdsec-supply-chain-breach-github-repositories%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrowdsec-supply-chain-breach-github-repositories%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrowdsec-supply-chain-breach-github-repositories%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks CISA Flags a WSO2 Flaw Already Under Active Exploitation Sep 28, 2026](https://codekeeper.co/ticker/cisa-wso2-vulnerability-cve-2026-5430)

[Cyberattacks Trezor Users Hit by Phishing After Brevo Platform Hack Sep 14, 2026](https://codekeeper.co/ticker/trezor-customers-phishing-attack-brevo-breach)

[Software security Citrix Confirms Two Actively Exploited NetScaler Zero-Day RCE Flaws Sep 28, 2026](https://codekeeper.co/ticker/citrix-urgent-patches-netscaler-flaws)

[More Northern Ireland Schools Hit by Cyber Attack Than First Thought Aug 12, 2026](https://codekeeper.co/ticker/ea-warns-of-c2k-network-cyber-attack)