Incident Responder: 2026-09-21

1. TanStack Supply Chain Attack Analysis

   CrowdSec, 2026-09-18. Read, 17 min.

   CrowdSec published its final report on the copying of about 170 of its private GitHub repositories on May 22, 2026, carried out with a GitHub OAuth token that the company attributes to the May 11 TanStack npm compromise as the likely vector. The report says the repositories were only cloned, that its infrastructure and databases were not accessed, and that the one usable credential in the dump, an AWS token scoped to a single SNS topic, was probed from an external address on August 17, 2026.

   Why it matters for this role: This is a scoping exercise written down: what the actor took, what CrowdSec could rule out, and where the evidence ran out. The audit-log limit is the part to carry into your own plan, because a repository clone may leave nothing you can query a week later.

Incident Responder