CrowdSec — TanStack npm Supply Chain Attack Exposes 170 Private GitHub Repositories (CVE-2026-45321)

Publication date: September 19, 2026
Category: Data Breach / Supply Chain Attack

Introduction

On September 18, 2026, cybersecurity firm CrowdSec disclosed that approximately 170 of its private GitHub repositories were copied without authorization on May 22. The breach was executed using lingering credentials belonging to a recently departed employee whose laptop was infected during the massive May 2026 supply chain attack targeting TanStack’s npm packages (officially tracked as CVE-2026-45321). This incident highlights the critical risks posed by improper access lifecycle management for former employees combined with vulnerabilities in modern open-source code dependencies.

What is CVE-2026-45321? (General Analysis)

CVE-2026-45321 represents a critical software supply chain vulnerability that impacted the npm ecosystem following the publication of 84 malicious versions across 42 packages under the @tanstack/* namespace.

According to official National Vulnerability Database (NVD) records and vendor advisories, this incident is characterized by the following confirmed parameters:

  • CVSS v3.1 Score and Severity: 9.6 (CRITICAL)
  • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
  • CWE Classification: CWE-506 (Embedded Malicious Code)
  • CISA KEV Catalog: Yes (Included in the Known Exploited Vulnerabilities catalog)

The critical risk stems from the fact that the compromised packages executed malicious scripts upon installation in developer environments, harvesting sensitive stored credentials such as GitHub tokens, SSH keys, and cloud environment secrets.

How Does It Work? (Technical Analysis)

The mechanism behind this security breach combined flaws in continuous integration automation and endpoint execution on developer machines:

  • Initial Infection Flow / Exploit Entry: On May 11, 2026, malicious actors published altered versions of TanStack packages leveraging legitimate GitHub Actions OIDC trusted-publisher bindings for TanStack/router, without modifying the underlying publish workflow itself.
  • Code Execution and Credential Theft: Installing the affected dependencies triggered injected code that chained multiple vulnerability classes (including a “Pwn Request” misconfiguration in pull_request_target, cache poisoning across fork-base boundaries, and runtime memory extraction from the Actions runner process) to harvest locally stored credentials.
  • Exfiltration via OAuth: In CrowdSec’s specific case, the attacker later used a GitHub OAuth token from the former employee’s active account—whose access had not been immediately revoked after departure—to clone the private repositories 11 days after the initial supply chain event.

Affected Systems / Environments

The attack was not confined to CrowdSec; multiple organizations relying on the TanStack development ecosystem experienced direct impacts on developer devices:

  • TanStack Ecosystem: 42 official packages under the @tanstack/* prefix with 84 malicious versions published between 19:20 and 19:26 UTC on May 11, 2026.
  • CrowdSec: Exposure of 170 private repositories (including web console, data science scripts, and consensus algorithms), user email addresses, and historical investor records from 2020.
  • Mistral AI: Involvement of at least one compromised developer device.
  • OpenAI: Two employee devices affected, with unauthorized access to a limited subset of internal code repositories.

Mitigation and Detection

Remediation

  • Immediate Credential Rotation: Promptly rotate all exposed API keys, GitHub tokens, and secrets across affected systems (actions executed by CrowdSec on September 16 and 17).
  • Access Hardening (Offboarding): Enforce strict policies to disable and revoke OAuth tokens, Personal Access Tokens (PATs), and GitHub accounts immediately upon an employee’s departure.
  • EDR Deployment: Ensure all engineering and development endpoints run Endpoint Detection and Response (EDR) software with continuous behavior monitoring capabilities.

Detection

  • Monitor GitHub audit logs for anomalous mass-cloning patterns or unusual OAuth token usage following staff transitions.
  • Automatically audit project dependencies using Software Composition Analysis (SCA) tools to identify compromised versions of third-party packages.

“The exploitation of lingering access tokens from former employees emphasizes the necessity of synchronizing human resources offboarding with automated identity revocation across version control platforms.”

Wrapping Up

The security incident experienced by CrowdSec, triggered by the TanStack supply chain attack (CVE-2026-45321), demonstrates that modern software security relies as heavily on public package registry integrity as it does on rigorous internal access hygiene (IAM). Although CrowdSec’s core infrastructure and public security engine remained uncompromised, the leakage of proprietary code and historical data mandates a comprehensive review of security controls across the entire software supply chain.

References