In May 2026, CrowdSec was impacted by a supply chain attack originating from the TanStack ecosystem, where malicious artifacts compromised an API key used by CrowdSec. This allowed attackers to access and exfiltrate source code from roughly 300 private and public GitHub repositories, including critical internal components such as the SaaS console and AWS automation scripts. CrowdSec confirmed no customer data or credentials were exposed and stated that the stolen code cannot be exploited independently without the associated environment and data. The company promptly rotated credentials and continues to monitor for suspicious activity. The breach is attributed to the short exploitation window during the TanStack supply chain compromise.

The breach resulted in the theft of CrowdSec's internal source code but did not expose customer credentials or data. The stolen code is considered of limited risk as it cannot be used outside CrowdSec's environment or without its data and tools. The incident may pose a risk to CrowdSec's intellectual property and could potentially aid attackers in understanding the company's internal architecture, but no immediate threat to customers or external systems was identified.

CrowdSec has rotated all potentially compromised API keys and credentials immediately following the breach. The company regularly audits its source code and monitors for abnormal activity. No further action is currently required as the stolen code cannot be exploited independently. Organizations using CrowdSec should remain informed through official communications but no direct mitigation steps are necessary for customers.