What is an npm supply chain attack in plain terms?

Developers install libraries (packages) from the npm registry to avoid writing all code from scratch. A supply chain attack means an adversary doesn't target the final product directly — instead they compromise one of those packages. When developers update their dependencies, the poisoned package installs automatically on thousands of machines and silently steals tokens, keys, and credentials.

Is my CrowdSec account data compromised?

CrowdSec confirmed that the production customer database, user passwords, and logs were not accessed. Exposed data includes email addresses belonging to 83 users found in a data-science repository, and names and contact details of 51 potential investors from 2020 records. If you are not in those groups, your login credentials are safe — but changing your password and enabling 2FA is always a sensible precaution.

Why did it take 117 days to detect the breach?

Three reasons. First, the attacker used a legitimate OAuth token from a former employee rather than forcing entry — no alarms triggered. Second, GitHub retains audit logs for only 7 days by default, wiping most of the forensic evidence before the breach was discovered. Third, the attacker remained largely dormant after the theft — one AWS token check in August — until publishing the archive on a forum.

← All news

September 21, 2026

TanStack npm Attack Exposed 170 Private CrowdSec Repos

Emily ParkerContent & SEO Specialist

TanStack npm Attack Exposed 170 Private CrowdSec Repos

In short: In May 2026, attackers poisoned 84 versions of popular TanStack npm packages. Every installation silently harvested GitHub tokens and SSH keys from developers' machines. One stolen token gave attackers 9 minutes to clone 170 private CrowdSec repositories. The breach went undetected for 117 days until the stolen code appeared on a hacker forum.

What is a software supply chain attack?

npm is the registry through which developers worldwide download ready-made libraries for their projects. When you use a web service or install an app, it almost certainly runs dozens of these packages internally. A supply chain attack doesn't compromise the final product directly — it compromises one of its dependencies during the build or update phase.

On May 11, 2026, an unidentified attacker exploited a vulnerability in TanStack's GitHub Actions workflow. TanStack is a popular JavaScript library for routing and data tables, with over 130 million monthly downloads. Through a three-step chain — an unsafe pull_request_target trigger, GitHub Actions cache poisoning, and OIDC token theft — the attacker gained the ability to publish packages under the TanStack project name. Eighty-four malicious releases across 42 @tanstack packages were pushed to the registry. The incident is tracked as CVE-2026-45321. Stay up to date on evolving threats in the LiMP VPN security blog.

The poisoned packages executed a hidden install-time script that harvested from the developer's machine: GitHub and npm tokens, SSH keys, and AWS, GCP, Kubernetes, and Vault credentials. Everything was sent to the attacker's server while the developer watched a normal installation progress bar.

Nine minutes to steal 170 repositories

On May 22, 2026, a former CrowdSec employee — who had worked at the French cybersecurity firm that makes open-source threat protection software — updated TanStack npm packages on their personal machine. They had already left the company, but their GitHub account with organisation-level permissions had not yet been revoked. This is a common offboarding gap: access is removed gradually rather than atomically.

The poisoned package stole their GitHub OAuth token. Hours later, from a Toronto IP address, the attacker used that token to clone CrowdSec's private repositories: 05:52 to 06:01 UTC, 170 repositories, 9 minutes and 4 seconds. The haul included the SaaS console source code, automation and deployment scripts, data-processing models, and critically — the consensus algorithm that drives CrowdSec's IP reputation system. On May 25 the former employee's account was finally removed — three days and 170 repositories too late.

117 days in the shadows

After the theft, the attacker moved slowly. On August 17 — nearly three months later — they tested the permissions of the stolen AWS token. Only on September 16, 2026 did an archive of CrowdSec's repositories appear on a cybercrime forum. That was when CrowdSec discovered it had been breached — 117 days after the actual theft.

The investigation was complicated by a structural limitation: GitHub retains audit logs for only 7 days by default. By the time the breach was discovered, key forensic evidence was gone. CrowdSec had to piece the timeline together from indirect signals. This is a hallmark of supply chain attacks: they don't force entry — they walk in with a legitimate key, tripping no alarms.

What was stolen and what it means for users

CrowdSec confirmed that production infrastructure, customer databases, and customer passwords were not accessed. However, the breach has serious implications:

Security algorithm source code. The logic behind CrowdSec's IP reputation lists — the product's core — is now in attacker hands. Adversaries can study it to develop evasion techniques.
Personal data of 83 users. Email addresses, plus names and contact details of 51 potential investors from 2020 records, are now exposed.
AWS credentials. The exposed role had limited permissions, but its presence in the archive creates a potential pivot point for further attacks.

The broader implication: when a security company's protective code is stolen, adversaries gain a blueprint for bypassing those exact defences. LiMP VPN operates independent infrastructure and does not rely on CrowdSec reputation lists — this incident does not affect our service.

How to reduce your risk

For ordinary users, the direct threat is minimal — you don't install npm packages manually. But you use services built by developers who do. A few practical steps:

Act on breach notifications. If a service you use reports an incident, change your password immediately and enable two-factor authentication.
Use unique passwords. A password manager ensures that compromising one service doesn't open the door to all the others.
Encrypt your traffic. Even if a service's backend code was compromised, a LiMP VPN subscription protects your data in transit — an attacker cannot intercept traffic between your device and the server.

For developers: run npm audit regularly, pin dependencies to exact hashes, revoke all departing employee access atomically across every system on their last day, and stream GitHub Audit Logs to external storage for at least 90 days.

Sources

← All news