CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

As cited

Copy frozen at 2026-09-19 08:59 UTC (site build).

breaches incidents

CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

CrowdSec disclosed that an attacker copied approximately 170 private GitHub repositories on May 22 by exploiting a departing employee's account that remained active. The employee's laptop had been compromised during May's TanStack supply chain attack, which involved malicious npm packages designed to steal credentials.

Why it matters: Organizations using GitHub and npm packages are affected: this illustrates how supply chain compromises can cascade into lateral attacks when access controls for departing employees are not promptly revoked.

Source published

2026-09-19 07:14 UTC

First seen by Cybersecurity Tracker

2026-09-19 08:15 UTC