CrowdSec says npm supply chain attack exposed 170 repositories

CrowdSec disclosed on 18 September 2026 that an attacker copied around 170 of its private GitHub repositories on 22 May 2026. According to the French security company, the attacker used the GitHub account of an employee who had just left the business. CrowdSec said it had kept that access open after his departure.

The company said the former employee's laptop was compromised in May's supply chain attack on TanStack, in which malicious versions of TanStack's npm packages stole credentials from developer machines. npm is the package registry most JavaScript and TypeScript projects pull code from, and a poisoned package runs on a developer's own computer during installation.

That combination is what turned one compromised laptop into a wider problem. The stolen credentials were still valid, because the account they belonged to had not been switched off. On CrowdSec's account of events, the attacker did not need to break anything at CrowdSec itself. They simply logged in.

The gap between the two dates is the other detail worth noting. The copying happened on 22 May 2026. The disclosure came on 18 September 2026, nearly four months later. CrowdSec has not, in the material disclosed so far, set out how the activity was eventually spotted, nor what the repositories contained.

For teams running AI coding agents and automated build pipelines, the pattern is familiar rather than exotic. Package installs pull third-party code onto trusted machines. Those machines hold long-lived tokens for source control. Tokens survive the people they were issued to. None of the steps in this chain required an agent, but every one of them is a step that agents now take at higher volume and with less human review than a developer typing commands by hand.

CrowdSec is itself a security vendor, which makes the offboarding lapse notable. The company confirmed the incident publicly rather than waiting for it to surface elsewhere, and attributed the initial compromise to the TanStack npm packages rather than to any failure on the employee's part.

What happened to the copied code afterwards is not described in the company's disclosure. There is no public indication of extortion, resale or publication of the repositories. Nor has CrowdSec said whether customer data was involved. Those questions remain open, and this report is limited to what the company has confirmed.