On 11 May 2026, 84 malicious versions of 42 @tanstack/* packages were published to the npm registry — a supply chain attack tracked as CVE-2026-45321 with a CVSS score of 9.6 (critical). The malicious code stole credentials from developers’ machines, including GitHub tokens, SSH keys, and cloud credentials. According to CrowdSec, this attack led to the compromise of a former employee’s laptop, and roughly 170 private GitHub repositories were copied via that account on 22 May. An archive containing source code and personal data appeared on an online forum on 16 September. The incident also affected OpenAI and Mistral AI.
How the TanStack supply chain attack worked
According to the official TanStack security advisory, the 84 malicious versions were published within a six-minute window — between 19:20 and 19:26 UTC on 11 May 2026. Each of the 42 affected packages received exactly two malicious versions. For example, for @tanstack/react-router these were versions 1.169.5 and 1.169.8, and version 1.169.9 was the patched one.
Installing any infected version launched an obfuscated router_init.js file (~2.3 MB), which collected and sent a broad set of credentials to external servers:
- AWS, GCP, Kubernetes, HashiCorp Vault credentials
- npm and GitHub tokens
- SSH keys
The data was exfiltrated via the domains filev2.getsession.org, seed1.getsession.org, seed2.getsession.org, and seed3.getsession.org. The malicious versions contained a distinctive indicator — an optional dependency @tanstack/setup pointing to the malicious Git ref github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c.
The vulnerability is classified as CWE-506 (embedded malicious code). The TanStack advisory explicitly states that development and CI/CD environments that installed an affected version on 11 May via npm, pnpm, or yarn should be considered compromised.
The CrowdSec incident: timeline and scope
According to information published by CrowdSec on 18 September, the sequence of events was as follows. A former employee left the company, but their access to GitHub was retained to allow them to finish ongoing work. Their laptop, the company reports, was compromised via the malicious TanStack package. Eleven days after the malicious versions were published, on 22 May, roughly 170 private repositories were copied using a GitHub OAuth token from the former employee’s account.
CrowdSec removed the account from its GitHub organization on 25 May — three days after the copying, but several months before the company learned of the leak. The company states that the token left no trace in the GitHub logs available to them and no longer existed at the time the leak was discovered. According to CrowdSec, GitHub support later traced the token’s history and confirmed its link to the TanStack attack.
It is important to note: attribution of the repository copying specifically to the compromised token of the former employee is based solely on CrowdSec’s statements and has not been confirmed by independent sources.
Contents of the leak
According to CrowdSec, the archive that appeared on an online forum on 16 September contained:
- Source code for the web console, scripts and data processing models, automation scripts
- The consensus algorithm that determines which IP addresses are added to blocklists, including previously non-public threshold values
- Email addresses of 83 CrowdSec users
- Names, email addresses, and investment context for 51 potential investors (data from 2020)
CrowdSec claims that the company’s infrastructure and databases were not affected and that no code was modified. According to the company, the only valid credential in the leak provided access only to an AWS SNS notification service with permission to publish to a single topic. An attempt to use it was recorded on 17 August — a month before the archive was published.
Inconsistencies in CrowdSec’s statements
CrowdSec’s report of 18 September significantly expanded the description of the consequences compared to the initial statement from 17 September. In the first statement, the company claimed: “No customer data, logins/passwords, names, organizations or anything else have been disclosed,” and that the impact was limited to the company itself. However, the very next day the report acknowledged a leak of data belonging to 83 users and 51 investors. The first statement also said that the malicious TanStack component had been found in CrowdSec’s code, whereas the 18 September report stated that no malicious TanStack versions were found in the company’s code and that the source of the incident was the former employee’s account.
Impact on other companies
The TanStack attack affected not only CrowdSec. According to an OpenAI statement, two employee devices were compromised, which led to unauthorized access to a limited set of internal source code repositories. OpenAI reported that it found no evidence of compromise of customer data or intellectual property, nor of any modification of released software. We have already written about other incidents involving OpenAI. Mistral AI also reported the compromise of a developer device in connection with this attack.
The incident shows that a supply chain attack has two distinct groups of victims. The first is any development or CI/CD environment that installed a malicious version of a TanStack package: they require a full investigation of the host and rotation of all accessible credentials. The second is organizations like CrowdSec, whose resources were compromised via stolen employee tokens.
Recommendations
For developers and DevOps teams using @tanstack/* packages:
- Check your dependencies: in manifests with pinned @tanstack/* versions, look for the optional dependency
@tanstack/setupand therouter_init.jsfile in the package root — these are indicators of compromise - Update the packages to the fixed versions listed in the TanStack advisory, and reinstall dependencies from a clean lockfile
- Rotate all credentials available on affected machines — prioritize rotation rather than just removing the package, since the malicious dependency could have been installed and removed without leaving traces in
node_modules - Check cloud audit logs (AWS CloudTrail, GCP Audit Logs) for unauthorized access using stolen credentials
- Check the exfiltration domains in network logs:
filev2.getsession.org,seed1-3.getsession.org
For organizations in general, the CrowdSec incident highlights the critical importance of immediately revoking departing employees’ access to all systems without exception, as well as the need to mandate endpoint protection tools on developers’ machines. CrowdSec acknowledged that at the time of the incident it did not require such software to be installed and introduced this requirement afterwards.
The CVE-2026-45321 TanStack supply chain attack is a confirmed case of exploitation in real-world conditions with a critical CVSS score of 9.6. Any teams that worked with @tanstack/* packages on 11 May 2026 should immediately check their environments for indicators of compromise, rotate credentials, and update packages to the fixed versions. Delays in rotating credentials create a window for attacks similar to those experienced by CrowdSec and OpenAI.
