CrowdSec confirms source code theft following TanStack supply chain attack
CrowdSec suffered a security breach after attackers compromised a TanStack dependency to gain unauthorized access to the company's source code repositories.
CrowdSec confirmed a supply chain attack in May 2026 where its source code was accessed and stolen. The breach originated from a compromised TanStack dependency, which attackers used as a foothold to pivot into the CrowdSec environment.
Security software frequently holds elevated permissions and visibility inside development pipelines. Attackers now target this inherent trust, using the dependency graph as the primary attack surface instead of traditional zero-day vulnerabilities.
Modern agentic systems interact with dozens of third-party packages and APIs during tool calls. These connections create potential pivot points for attackers to reach environments where agents hold credentials.
Many agentic pipelines currently lack mechanisms to verify the ongoing integrity of consumed tools. An agent authorized to use a dependency early in a development cycle has no native method to detect a later package compromise. Security teams face new decisions about whether dependency integrity belongs in upstream package management or directly inside the trust model governing autonomous agent actions.