CrowdSec GitHub Repository Leak

CrowdSec just disclosed a leak that started with a former employee's GitHub account. An attacker copied about 170 private repositories on May 22. The code showed up on an online forum on September 16.

The French security company published its report on September 18. The short version: a former employee's laptop was compromised in the TanStack supply chain attack. CrowdSec had left his GitHub access open so he could finish some work. That access was used to copy code.

Here's what happened, what leaked, and what it means.

Quick Summary

How the Code Was Taken

On May 11, 84 malicious versions of 42 TanStack npm packages were published. That compromise is tracked as CVE-2026-45321. Installing one of those versions ran code that stole credentials from the machine. GitHub tokens, SSH keys, cloud credentials. Anything it could grab.

CrowdSec says the copy happened 11 days later. The attacker used a GitHub OAuth token from the former employee's account. CrowdSec had kept his access so he could finish up some work.

The company removed his account from its GitHub organization on May 25. That was three days after the copy. But it didn't learn about the leak until much later.

His other access had already been removed. That's why CrowdSec says it saw no suspicious activity in its AWS systems.

The token left no trace in the GitHub logs CrowdSec could check. It no longer existed when the company learned of the leak. GitHub support traced the token's history and confirmed CrowdSec's suspicion that TanStack was the source.

CrowdSec did not say which malicious package reached the former employee's laptop or when. Its report does not include GitHub's own findings. It says its developers' machines were checked and came back clean.

Other companies were hit too. Mistral AI said a developer device was involved. OpenAI said two employee devices were affected, with unauthorized access to a limited set of internal code repositories.

What Leaked

The leaked code came from CrowdSec's private repositories. Not the public Security Engine. According to the company, it includes:

• The web console
• Data science scripts and models
• Automation scripts
• The consensus algorithm that decides which IP addresses get added to blocklists

CrowdSec says the code is almost four months old and has changed a lot since.

The leak also revealed thresholds used by the consensus algorithm. Things like how many detections it requires before adding an IP address to the blocklist. Those had not been public before.

The code appeared on an online forum on September 16. Along with the source code, it contained:

• Email addresses of 83 CrowdSec users
• Names, email addresses, and investment context of 51 potential investors from 2020

CrowdSec says it will contact those users and investors.

What Didn't Leak

CrowdSec says the account was used only to copy code. Its infrastructure and databases were not accessed. No code was changed.

The company says the only usable credential in the leak was for AWS's SNS notification service. It could only publish messages to one topic. Someone tried to use it on August 17, a month before the code was posted, but got no further.

Other tokens in the code had already been rotated or could not be used from the internet, as far as CrowdSec knows.

Is the Blocklist at Risk?

CrowdSec says the blocklist still cannot be poisoned. That means nobody can trick it into blocking a harmless IP address.

To do that, an attacker would need tens of detections from tens of trusted engines across tens of separate networks. That's expensive and impractical. CrowdSec also says it can change the thresholds, and it often does.

So the algorithm details are out there. But the system itself is still holding.

The Timeline

The First Statement vs. the Report

CrowdSec's September 18 report differs from its first statement on September 17.

The first statement said: "No client data, login/password, name, organization, or anything else was leaked." It said the impact was limited to the company.

The first statement also named TanStack as the very likely source. It said a component used inside CrowdSec in May appeared to have been backdoored to steal an API key that could read the private code.

The September 18 report says none of the malicious TanStack versions were found in CrowdSec's code. It points instead to the former employee's account. It also lists the investors' names, which the first statement said had not leaked, along with the 83 users' email addresses.

CrowdSec CEO Philippe Humeau wrote to investors in the report: "For this I personally apologize."

What CrowdSec Is Doing

The company rotated the exposed credentials on September 16 and 17. It did not require endpoint protection software on developers' machines at the time. It now runs such software on laptops of staff who work with its code or systems.

Neither CrowdSec's report nor its first statement asks users to take any action.

CrowdSec says it has about 150,000 users. Its data science team kept the 83 exposed email addresses to study how people used the product. The investors' details came from a 2020 system that CrowdSec says was never meant to be public. The company says it will report the leak to investors and authorities.

What Other Companies Should Learn

This wasn't a sophisticated hack. It was a former employee's account left open. A compromised laptop. A token that still worked.

Lessons for companies:

• Offboarding is a process, not a checkbox. If someone leaves, remove access immediately. Don't leave it open for "a few more tasks."
• Tokens outlive employees. A GitHub OAuth token can be used long after someone is gone. Rotate credentials when people leave.
• Endpoint protection matters. CrowdSec didn't require it at the time. Now it does. That's a lesson learned the hard way.
• Supply chain attacks have long tails. The TanStack compromise happened in May. The leak surfaced in September. Damage can take months to appear.
• Be careful with old systems. The investor data came from a 2020 system that was never meant to be public. Old data is still data.

The Bottom Line

An attacker used a former CrowdSec employee's GitHub token to copy about 170 private repositories. The code appeared on a forum in September. It exposed 83 user emails and 51 investor records. CrowdSec says its infrastructure and databases were not accessed. The blocklist is still safe. No user action is required, but the company has apologized to investors and is rotating credentials.

Quick Reference:

What to Do:

• Review your offboarding process
• Rotate credentials when employees leave
• Require endpoint protection
• Track supply chain attack fallout
• Audit old systems holding sensitive data

FAQ Section

What happened in the CrowdSec GitHub repository leak?

An attacker used a former employee's GitHub OAuth token to copy about 170 private repositories on May 22, 2026. The code appeared on an online forum on September 16.

How did the attacker get the token?

Laptop belonging to the former employee was compromised during TanStack npm supply chain attack. That attack stole credentials from developers' machines, including GitHub tokens.

Was customer data exposed?

Yes. The leaked code contained email addresses of 83 CrowdSec users and names, emails, and investment context of 51 potential investors from 2020.

Is CrowdSec's blocklist at risk?

CrowdSec says no. Poisoning the blocklist would require tens of detections from tens of trusted engines across tens of networks. The company also says it can change the thresholds.

Do CrowdSec users need to do anything?

No. Neither CrowdSec's report nor its first statement asks users to take action. The company says it will contact affected users directly.

Source: The Hacker News