An attacker copied about 170 of CrowdSec’s private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18.
The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May’s supply chain attack on TanStack, in which malicious versions of TanStack’s npm packages stole credentials from developers’ machines.
The code appeared on an online forum on September 16. Along with the source code, it contained the email addresses of 83 CrowdSec users and the names, email addresses, and investment context of 51 potential investors from 2020, the company said.
CrowdSec says the account was used only to copy code, that its infrastructure and databases were not accessed, and that no code was changed.
How the Code Was Taken
On May 11, 84 malicious versions of 42 TanStack npm packages were published. The compromise is tracked as CVE-2026-45321. Installing one of those versions ran code that stole credentials from the machine, including GitHub tokens, SSH keys, and cloud credentials, according to TanStack’s advisory.
The company says the copy was made 11 days later with a GitHub OAuth token from the former employee’s account. The company had kept his access so he could finish some work.
CrowdSec removed his account from its GitHub organization on May 25, three days after the copy and months before it learned of the leak. His other access had already been removed, which the company says explains why it saw no suspicious activity in its AWS systems.
The token left no trace in the GitHub logs it could check and no longer existed when it learned of the leak. It says GitHub support then traced the token’s history and confirmed its suspicion that TanStack was the source.
CrowdSec did not say which malicious package reached the former employee’s laptop or when, and its report does not include GitHub’s own findings. It says its developers’ machines were checked and came back clean.
The same attack also reached other companies. Mistral AI said a developer device was involved in its case, and OpenAI said two employee devices were affected, with unauthorized access to a limited set of its internal code repositories.
What the Archive Held
CrowdSec’s open-source Security Engine detects attacks on servers, and users who share their detections receive a shared blocklist of malicious IP addresses. The leaked code comes from the company’s private repositories, not this public engine.
According to the company, the code includes its web console, data science scripts and models, automation scripts, and the consensus algorithm that determines which IP addresses are added to the blocklists.
It says the code is almost four months old and has changed a lot since.
CrowdSec says the leak also revealed the thresholds the consensus algorithm uses, such as how many detections it requires before adding an IP address to the blocklist. These had not been public before.
As far as it knows, the blocklist still cannot be poisoned, meaning tricked into blocking a harmless IP address. It says an attacker would need tens of detections from tens of trusted engines across tens of separate networks, at great cost. CrowdSec also says it can change the thresholds, as it often does.
According to the company, the only usable credential in the leak was for AWS’s SNS notification service, and it could only publish messages to one topic. Someone tried to use it on August 17, a month before the code was posted, but got no further. Other tokens in the code had already been rotated or could not be used from the internet, as far as the company knows.
CrowdSec says it has about 150,000 users. Its data science team kept the 83 exposed email addresses to study how people used the product, and the company says it will contact those users.
The investors’ details came from a 2020 system that CrowdSec says was never meant to be public. The company says it will report the leak to the investors and to the authorities. CEO Philippe Humeau wrote to the investors in the report that “for this I personally apologize.”
The affected company rotated the exposed credentials on September 16 and 17. It did not require endpoint protection software on developers’ machines at the time, but it now runs such software on the laptops of staff who work with its code or systems.
Neither CrowdSec’s report nor its first statement asks users to take any action.
How CrowdSec’s Account Changed
CrowdSec’s September 18 report differs from its first statement, published a day earlier. In that statement, CrowdSec said “No client data, login/password, name, organization, or anything else was leaked,” and that the impact was limited to the company.
The first statement also named the TanStack compromise as the very likely source of the leak. It said a component used inside CrowdSec in May appeared to have been backdoored to steal an API key that could read the private code.
The September 18 report says none of the malicious TanStack versions were found in CrowdSec’s code, and points instead to the former employee’s account. It also lists the investors’ names, which the first statement said had not leaked, along with the 83 users’ email addresses.
