CrowdSec's GitHub breach: six months from TanStack npm attack to repo exfiltration
CrowdSec disclosed that attackers copied approximately 170 of its private GitHub repositories after a former employee's GitHub account was compromised via the May 2026 TanStack npm supply chain attack. The attacker harvested a developer token in May and used it months later, long after the developer had left the company. The incident is a clear illustration of the supply chain long tail, a risk that gets underreported after initial incident response closes.
How the attack unfolded
In May, attackers published malicious packages to npm under the TanStack scope, a popular JavaScript query library with millions of weekly downloads. The malicious packages harvested developer tokens from machines that installed them. One of those tokens belonged to a developer who was working at CrowdSec at the time. The developer later left the company. The token was then used to access CrowdSec's private GitHub repositories, months after the TanStack disclosure and months after the developer had offboarded.
The offboarding gap
SSO account deprovisioning is now standard practice for most companies. GitHub personal access tokens, fine-grained tokens, SSH keys added to organization repositories, and credentials stored in developer tooling are not always included in that process. A token stolen before offboarding, if not explicitly revoked as part of the offboarding workflow, remains valid indefinitely. That is what happened here, and it is far more common than organizations realize.
Supply chain incidents have long tails
The TanStack compromise affected many organizations. Most completed their incident response and moved on. CrowdSec is evidence that the blast radius of a supply chain attack continues to expand after the initial disclosure and remediation. Credentials stolen in a supply chain attack can remain dormant for months before being weaponized. Organizations should treat supply chain incident response as an ongoing process and audit for tokens that may have been exposed even if no immediate harm was detected at the time.
What to check now
Review your offboarding checklist to confirm it explicitly includes revocation of GitHub personal access tokens, fine-grained tokens, SSH keys added to organization repositories, and any third-party developer tool credentials. If your organization had developers installing TanStack or related npm packages in May, audit your GitHub audit log for access from accounts that have since been deprovisioned. Rotate any token where there is doubt about whether it was exposed.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to review your offboarding processes or need a supply chain security assessment.