CrowdSec Source Code Stolen in TanStack Supply Chain Attack

CrowdSec confirms attackers took code from about 170 private GitHub repos, along with emails of 83 users and 51 prospective investors. Credentials rotated.

By Content Team

Sep 26, 2026

ON THIS PAGE

French cybersecurity firm CrowdSec confirmed that attackers copied roughly 170 of its private GitHub repositories in May 2026, a theft that only came to light when the archive appeared on a hacking forum on September 16.

CrowdSec traced the breach to the May 11 TanStack supply chain attack, in which an attacker published 84 malicious versions across 42 npm packages. The malware compromised a recently departed developer still in CrowdSec's GitHub organization, whose OAuth token was used to clone the code on May 22.

The private code covers CrowdSec's SaaS console, AWS cloud routines, connectors, and automations. The dump also held the email addresses of 83 users and the names, emails, and investment context of 51 prospective investors from 2020, which CrowdSec is reporting to them and the authorities.

CrowdSec has rotated all exposed credentials. It says the code has little value outside its own environment, though it concedes full source access could speed up hunting for weaknesses.

Source: CrowdSec

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?