CrowdSec kept a leaver's GitHub access open so he could finish some work, his laptop was hit by the TanStack npm compromise on May 11, and the repositories were copied on May 22 and posted to a forum on September 16.
Perspective Coverage
4 publishers
- Builder
- Builder 34%
- Operator
- Operator 51%
- Investor
- Investor 15%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap−25
- Incentives65
- Confidence58
buildOne report1 publisher Netban bans an SSH bot's whole /24 in nftables ahead of UFW's allow-22 rule
Netban, a Bash script posted on dev.to, bans an SSH bot's whole /24 for 24 hours by default. Its author built it after one bot tripped Wazuh 91 times. Bans live in a separate nftables table and expire by themselves, leaving existing UFW or firewalld rules untouched.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap−5
- Incentives30
- Confidence45
An ex-employee's live OAuth token let strangers copy 170 CrowdSec repositories in nine minutes
TeamPCP's npm compromise of TanStack reached CrowdSec through a departed employee's laptop, and the company learned its private repositories had been copied only when the code surfaced on a dark web forum in September.
Reality
- Evidence58
- Adoption55
- Hype gap+12
- Incentives72
- Confidence60
buildConfirmed2 publishers CrowdSec's final analysis puts the entry point in a former employee's development environment, hit by the TanStack npm malware in May. Its own organisation audit logs did not keep the clone events, so GitHub Support supplied them.
Publishers:dev.to · thearabianpost.com Reality
- Evidence62
- Adoption32
- Hype gap−8
- Incentives72
- Confidence58
buildOne report1 publisher A backdoored TanStack dependency lifted the CI key that could read CrowdSec's private repositories
TanStack closed out its package compromise on May 15th, and CrowdSec learned 124 days later that the same incident had cost it a CI credential with read access to its private code. The notice came from an outside researcher.
Reality
- Evidence46
- Adoption55
- Hype gap+12
- Incentives74
- Confidence55
buildOne report1 publisher Exploitation beat CVE publication for about 256 vulnerabilities last year
VulnCheck logged 884 vulnerabilities with first-time exploitation evidence in 2025, and 28.96% of them were already being exploited by the day their CVE appeared, up from 23.6% a year earlier. The same report calls the year's timing highly consistent with 2024.
Reality
- Evidence52
- Adoption
- Not scored
- Hype gap+18
- Incentives78
- Confidence48