CrowdSec has disclosed that an attacker copied about 170 private GitHub repositories using credentials stolen in the TanStack npm supply-chain compromise. The unauthorized cloning took place on May 22 but was not connected to the intrusion until stolen code appeared on a cybercrime forum on September 16.

The breach shows how a malicious dependency can have consequences long after the affected package is removed. In this case, the most valuable target was not a production server but an already-authorized developer identity whose access remained valid after the employee had left the company.

Poisoned packages harvested developer credentials

The incident traces back to CVE-2026-45321 and the compromise of the TanStack Router and Start ecosystem. The attacker reportedly abused an unsafe pull_request_target workflow, poisoned a GitHub Actions cache and extracted an OpenID Connect token at runtime. That chain enabled the publication of 84 malicious releases across 42 packages in the @tanstack namespace.

Install-time code in the packages was designed to search infected systems for high-value secrets. Its targets included GitHub and npm tokens, cloud credentials, Kubernetes and Vault secrets, and SSH keys. Such access can bypass protections at the account login screen because the malware steals a token from a session that has already been authorized.

A former employee account opened the repositories

CrowdSec said the compromised identity belonged to a recently departed developer who temporarily retained GitHub access to complete work. Between 05:52 and 06:01 UTC on May 22, an intruder used an OAuth token tied to that account to clone repositories from an IP address in Toronto. The company removed the former employee from its GitHub organization on May 25, unaware that the downloads had already occurred.

Investigators later found a decisive clue inside the leaked archive: a Git configuration file contained a credential beginning with the prefix GitHub uses for OAuth access tokens. Repository timestamps and recent commits narrowed the theft window, while GitHub support reconstructed the expired token’s lifecycle and provided activity records for the relevant period.

What the stolen material contained

The copied material included code for CrowdSec’s SaaS console, data-science scripts and models, deployment automation, and its consensus algorithm for adding malicious addresses to blocklists. More than 130 repositories in the archive were already public. CrowdSec said the attacker did not enter production infrastructure or databases, did not alter source code or pipelines, and performed only Git fetch operations through the exposed account.

Some personal and operational data was nevertheless present. The leak included email addresses for 83 users and information about 51 potential investors dating from 2020. An active AWS credential limited to publishing notifications to one SNS topic was also exposed. It was tested in August, but the investigation found no evidence of broader cloud access.

Long-term logging and rapid offboarding are essential

CrowdSec rotated credentials, reviewed activity, notified affected people and strengthened monitoring. It also made endpoint detection and response mandatory on developer workstations, adding to controls that included hardware-backed authentication, secret storage, code scanning and restrictions on newly published packages.

• Treat machines that installed affected package versions as compromised and rebuild them from trusted images.
• Rotate every credential that an install script could read, not only npm tokens.
• Remove access promptly when staff leave and closely control OAuth applications.
• Stream source-control audit events to durable external storage instead of relying on short default retention.
• Pin dependencies, limit lifecycle scripts and monitor developer endpoints for credential harvesting.

The lesson is that multifactor authentication does not protect a token already present on an endpoint. Supply-chain defense must cover the developer workstation, identity lifecycle and historical evidence needed to reconstruct an intrusion months later. Visibility matters.