CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

CrowdSec reported that an attacker copied around 170 of its private GitHub repositories on May 22. The breach occurred using the account of a former employee whose GitHub access had not been revoked. The employee's laptop was compromised during a supply chain attack on TanStack in May, which involved malicious versions of TanStack's npm packages stealing credentials. The incident was disclosed by CrowdSec on September 18. The attack on TanStack's npm packages led to the compromise of the employee's laptop, ultimately resulting in the theft of CrowdSec's private repositories. CrowdSec's failure to revoke the former employee's GitHub access contributed to the breach.