September 20, 2026
- CrowdSec disclosed on 18 September that an attacker copied roughly 170 of its private GitHub repositories on 22 May using the still-active account of an employee who had just left. The laptop was compromised in May's TanStack npm supply-chain attack, which stole credentials from developers — a clean illustration of offboarding lag turning a third-party package compromise into vendor source-code exposure. The Hacker News · Cloud, Identity & Supply Chain
in Threat Actors Turn on Each Other as Gemini Walks Into Three Real Networks