CrowdSec: Source Code Stolen from 170 Private Repos —…

On September 16, 2026, source code from roughly 170 private CrowdSec repositories appeared on a criminal forum. The exfiltration occurred on May 22, four months earlier, via a former employee's OAuth token — compromised through the TanStack npm supply-chain attack. CrowdSec disclosed the incident on September 17–18, revealing an operational gap: the ex-employee's GitHub access remained active after departure.

On September 16, 2026, source code from approximately 170 private CrowdSec repositories surfaced on a criminal forum. The exfiltration had taken place on May 22 — four months prior — using the OAuth token of a former employee whose laptop was compromised by malware distributed via npm in the TanStack supply-chain attack. The incident, disclosed by CrowdSec on September 17–18, highlights an operational blind spot: the employee's GitHub access had been left active after their departure.

Key Takeaways

Supply-chain chain: On May 11, 2026, 84 malicious versions across 42 @tanstack/* packages were published to npm; a former CrowdSec employee's OAuth token was used on May 22 to clone private repositories.
The theft went undetected for roughly four months: CrowdSec revoked the token on May 25 without realizing exfiltration had occurred, and only discovered the leak when it appeared on a forum on September 16.
Impact includes SaaS console code, consensus algorithms, data-science scripts and automations; 83 user email addresses and 51 prospective investor contacts from 2020 were exposed.
CrowdSec rules out access to customer data, production infrastructure, or code modifications; an AWS SNS token was tested on August 17 but yielded no further access.

The Attack Chain: From npm to Private Repositories

The attack originated on the afternoon of May 11, 2026, when 84 malicious versions across 42 packages in the @tanstack namespace were published to npm, according to the GitHub Security Advisory. The publishing pipeline was compromised by exploiting a misconfigured GitHub Actions pull_request_target workflow, using cache-poisoning and runtime OIDC token extraction techniques.

The malware embedded in the tainted packages harvested GitHub tokens, cloud credentials, and SSH keys from developers' machines. Among the compromised devices was the laptop of a former CrowdSec employee who still had access to the company's GitHub organization. The OAuth token on that device was used to copy roughly 170 private repositories in an operation lasting under ten minutes, from 05:52:29 to 06:01:33 UTC on May 22, from an IP address located in Toronto, Canada, according to logs reconstructed by CrowdSec with GitHub's assistance.

The token was revoked three days later, on May 25, but the company had not detected the exfiltration. GitHub support reconstructed the token's lifecycle to confirm the link to the TanStack compromise.

Residual Access: When Offboarding Leaves the Door Open

The decisive factor in the incident is the persistence of digital identity beyond the end of employment. CrowdSec had kept the former employee's GitHub access active. At the time of the event, EDR had not yet been deployed; CrowdSec does not explicitly attribute the lack of detection to this absence.

GitHub Enterprise audit-log retention is limited. The four-month delay made real-time forensic analysis of corporate logs impossible. It was GitHub support that retrospectively reconstructed the token's lifecycle.

"It's really unfair; we couldn't do much about it, and it will have a negative impact on us" — Philippe Humeau, CEO of CrowdSec, on CrowdSec's position as a supply-chain victim

What Was Exposed — and What Wasn't

The cloned private repositories contained the SaaS console source code, AWS Cloud routines, connectors, and automations, as stated in CrowdSec's initial communication on September 17. Also exfiltrated were the platform's consensus algorithms, data-science scripts, and models.

The exposure of the consensus algorithms is particularly significant: according to CrowdSec, the leak "does not allow compromising the integrity of the blocklist, but before the leak the attacker did not know exactly how many signals were required; now the thresholds are known."

Alongside the code, 83 user email addresses were exposed — representing less than 0.05% of the roughly 150,000-user base — and 51 prospective investor contacts from 2020, including names, emails, and investment context. CEO Philippe Humeau issued personal apologies to the latter group.

An active AWS SNS token was found among the exfiltrated materials; it was tested on August 17, 2026, by an unknown party, but according to CrowdSec it granted no additional access and was limited to a single SNS topic.

CrowdSec categorically ruled out access to customer data, user credentials, production infrastructure, and databases, as reiterated in both the initial statement and the full report of September 18. No code was modified by the attackers.

The Detection Gap: A Four-Month Delay

The delay between exfiltration and discovery — roughly four months — is the most troubling dimension of the incident. CrowdSec itself expressed surprise at the timeline: September 16 was "a day that happened," in the words of the company report.

The gap reflects the combination of two documented factors: the absence of EDR at the time of the event, and the silent nature of exfiltration via an already-authorized token. The company stated it conducted an active hunt for tokens, credentials, and sensitive leaks immediately after discovery, finding no lateral-movement vectors.

What Changes

In DeafNews's assessment, the CrowdSec incident yields three documented field lessons.

First: revoking access at offboarding, without exceptions for residual activity, reduces the attack surface. The brief does not specify whether CrowdSec has changed this practice since the incident.

Second: detecting exfiltration via authorized tokens requires behavioral log monitoring, not just EDR presence. The brief does not detail which controls CrowdSec has since implemented.

Third: CrowdSec's transparent response — detailed technical report, disclosure of exposed thresholds, apologies to investors — represents a disclosure model that contrasts with industry norms. The source does not specify whether this approach has been assessed as reputational-damage mitigation.

The reconstruction relies primarily on the CrowdSec report and the GitHub advisory; journalistic sources converge but do not add independent primary elements.

Frequently Asked Questions

Are CrowdSec customers at risk? According to the company, no: CrowdSec states that no customer data, credentials, or production infrastructure were accessed. The CEO said the primary impact concerns source-code visibility.

Is the CrowdSec blocklist compromised? According to CrowdSec, the blocklist cannot be compromised based solely on the exposed thresholds; the company asserts the attacker cannot alter its integrity with the information obtained.

Editorial Close

The CrowdSec case is rare for its documentary transparency. The company published timestamps, IP addresses, token scope, and specific impact, enabling external fact verification. This level of disclosure does not erase the damage — the source code remains exposed — but it gives the community a concrete reference point on the risks of residual access.

In DeafNews's assessment, the structural lesson is clear: technical offboarding must be immediate and total, without operational exceptions. The brief does not specify whether CrowdSec had written procedures to that effect before May 2026.

Information has been verified against the cited sources.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter