How a poisoned coding library led to 170 private repos being copied at CrowdSec
A French security firm says a departing employee's laptop was infected through the TanStack npm supply-chain attack in May. The fallout reached its GitHub.
Key points - CrowdSec says an attacker copied around 170 of its private GitHub repositories on 22 May 2025, using the still-active account of an employee who had just left. - The company traces the break-in to the May supply-chain attack on TanStack, a popular set of open-source coding tools, which shipped credential-stealing versions of its npm packages. - TanStack's maintainers list dozens of affected packages and say the fix landed in version 1.166.16. - CrowdSec disclosed the incident on 18 September 2025, roughly four months after the copy took place. - The company says its production systems and customer data were not touched.
A small offboarding mistake plus a poisoned developer library. That's all it took.
CrowdSec, a French cybersecurity company that sells crowd-sourced threat intelligence, said on 18 September that an intruder cloned about 170 of its private code repositories on GitHub back on 22 May. The attacker logged in as an employee who had already left the company and whose GitHub access had never been revoked.
That account was compromised weeks earlier, CrowdSec says, through the TanStack supply-chain attack. TanStack makes widely used JavaScript tools for building web apps. In May, someone pushed malicious versions of its npm packages, the small building blocks developers download and stitch into their own software, and those versions quietly stole credentials from any machine that installed them.
The advisory from TanStack's maintainers lists more than thirty affected packages, including @tanstack/react-router, @tanstack/react-start and @tanstack/router-cli, with tainted releases at versions 1.166.12 and 1.166.15. The clean release is 1.166.16.
How did the attacker get in?
Through a laptop that was already infected, using an account that should have been switched off.
CrowdSec's account of the timeline, first reported by The Hacker News, is that the employee's development machine ran a poisoned TanStack package in May. That package harvested tokens and secrets, including a GitHub credential tied to the employee's CrowdSec account. When he left, nobody deactivated it. On 22 May the attacker used it to pull down roughly 170 private repositories in one pass.
Nothing inside those repositories was altered. Production systems weren't touched, and the CrowdSec detection engine kept running normally. What the attacker walked away with is source code and whatever was inside it.
What was in the repositories?
CrowdSec hasn't published a full inventory. Private code repositories typically hold source code, internal documentation and configuration files, and sometimes secrets that developers checked in by accident, such as API keys or database passwords. Any of those, if present, would need to be rotated.
The practical worry with a source-code theft is slower-burning than a ransomware hit. Attackers read the code for weaknesses, for hard-coded credentials, for a map of how a company's systems talk to each other. That work takes time to show up.
What should developers using TanStack do?
Upgrade to 1.166.16 or later, and treat any machine that installed 1.166.12 or 1.166.15 as potentially credential-stolen.
| Item | Detail |
|---|---|
| Compromised versions | 1.166.12, 1.166.15 |
| Fixed version | 1.166.16 |
| Advisory ID | GHSA-g7cv-rxg3-hmpx |
| CrowdSec repos copied | ~170 |
| Date of copy | 22 May 2025 |
| Disclosure | 18 September 2025 |
Rotate npm tokens, GitHub personal access tokens, cloud keys and any browser-stored secrets on affected developer machines. Check GitHub audit logs for unexpected clones or downloads dated on or after mid-May. Our 11 August story on why GitHub activity logs catch supply-chain attacks early walks through what to look for.
This one's uncomfortable because the npm ecosystem keeps producing these events, but the blast radius here wasn't decided by the malicious package. It was decided by what CrowdSec did the day an employee walked out the door. They got that part wrong, and they said so. Plenty of companies have the same gap and haven't been forced to find out.
