AI-generated editorial illustration; not a documentary photograph.
CrowdSec says an attacker copied about 170 of its private GitHub repositories on May 22 using an OAuth token tied to a recently departed employee. The company linked the credential theft to malicious TanStack npm packages installed on the former employee's compromised laptop.
Access Survived Departure
CrowdSec had intentionally left the former employee's GitHub access active so he could complete work, although his other access had been removed. The company removed the account from its GitHub organization on May 25, three days after the repositories were copied and months before CrowdSec learned that the code had leaked.
The wider supply-chain incident began on May 11, when 84 malicious versions of 42 TanStack npm packages were published. Tracked as CVE-2026-45321, the compromise could steal GitHub tokens, SSH keys and cloud credentials from developer machines, according to TanStack's advisory.
Private Data Exposed
The archive appeared on an online forum on September 16. CrowdSec says it contained code for its web console, data science work, automation and the consensus system used to decide which IP addresses enter shared blocklists. The company's public, open-source Security Engine was not the source of the leaked code.
CrowdSec also identified email addresses belonging to 83 users and names, email addresses and investment context for 51 potential investors from 2020. It said the code was nearly four months old but disclosed previously private thresholds used by the consensus algorithm.
Impact Remains Company-Assessed
CrowdSec says its infrastructure and databases were not accessed, no source code was altered and it has found no evidence that attackers can poison its blocklist. One exposed AWS SNS credential could publish only to a single notification topic; an attempted use on August 17 reportedly went no further. Other credentials were already rotated or inaccessible from the internet, according to the company.
The report does not identify which malicious package reached the laptop or when, and it does not include GitHub's own findings. CrowdSec says GitHub support traced the expired token's history, while checks of current developers' machines found no compromise.
Initial Account Revised
CrowdSec's September 18 report expanded and corrected its first statement from the previous day, which had said no user identities or other external data were leaked. The company rotated exposed credentials on September 16 and 17, began requiring endpoint protection on laptops used to access its code or systems, and said it would notify affected users, investors and authorities. Neither statement asked users to take action.
Source: CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
SIGNAL TITANS
Leave a Reply