NewsThe Hacker News2026-09-19 07:14 UTCSME Finance

CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May's supply chain attack on TanStack, in which malicious versions of TanStack's npm packages stole credentials from

Other advisories

CVE-2026-44982high
go github.com/crowdsecurity/crowdsec: Protection Mechanism Failure
CVE-2026-44981high
go github.com/crowdsecurity/crowdsec: Improper Handling of Highly Compressed Data (Data Amplification)
CVE-2026-44982high
go github.com/crowdsecurity/crowdsec: Protection Mechanism Failure
osv:CVE-2026-44982none
CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests
osv:CVE-2026-44981none
CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression
CVE-2026-44981high
go github.com/crowdsecurity/crowdsec: Improper Handling of Highly Compressed Data (Data Amplification)
CVE-2026-44982none
CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests in github.com/crowdsecurity/crowdsec
CVE-2026-44981none
CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression in github.com/crowdsecurity/crowdsec

Other news entries

Newsdarkreading2026-09-22
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data
Newssecurityweek2026-09-21
CrowdSec Confirms Source Code Stolen in Supply Chain Attack
Newsheise-security
Quellcode geklaut: Unbekannte steigen per Supply-Chain-Angriff bei CrowdSec ein

Source: https://thehackernews.com/2026/09/crowdsec-says-tanstack-npm-attack-led.html

More on CrowdSec