Executive Summary
In May 2026, the security firm CrowdSec suffered a source code leak involving approximately 170 private GitHub repositories. The incident was traced back to a supply chain compromise of the widely used TanStack npm package repository (CVE-2026-45321). The threat actor, identified as TeamPCP (also tracked as UNC6780), utilized a malicious version of these packages to deploy the 'Shai Hulud' malware, which specialized in credential and token harvesting.
The technical analysis indicates that a former CrowdSec employee’s personal laptop was infected by a backdoored TanStack package, allowing the attacker to obtain a GitHub OAuth token. This token was used on May 22, 2026, to clone the organization's private codebase. Although CrowdSec's core infrastructure and databases remained secure, the leak included sensitive internal components such as data science models, the proprietary Consensus Algorithm for IP blocklisting, and PII of 83 users and 51 historical investors.
This event underscores the critical risks posed by supply chain dependencies in the JavaScript ecosystem. While the functional impact on CrowdSec's network security operations was limited due to scoped tokens and legacy code rotation, the exposure of internal algorithmic thresholds could facilitate future evasion attempts against their IP reputation systems.