Attacker copied 170 CrowdSec repositories with a departed employee's still-live GitHub token

CrowdSec said on September 18 that an attacker copied about 170 of its private GitHub repositories on May 22 using the account of an employee who had just left.

CrowdSec is a French security company and had kept the departed employee's GitHub access open.

CrowdSec says the copy was made 11 days after the malicious packages were published, using a GitHub OAuth token from the former employee's account, and that it had kept his access so he could finish some work.

CrowdSec says it has about 150,000 users; its data science team kept the 83 exposed email addresses to study how people used the product, and the company says it will contact those users.

The copied code appeared on an online forum on September 16.

The investors' details came from a 2020 system that CrowdSec says was never meant to be public, and the company says it will report the leak to the investors and to the authorities.

CEO Philippe Humeau wrote to the investors in the report that "for this I personally apologize."

CrowdSec says the account was used only to copy code, that its infrastructure and databases were not accessed, and that no code was changed.

On May 11, 84 malicious versions of 42 TanStack npm packages were published; the compromise is tracked as CVE-2026-45321.

Installing one of the malicious versions ran code that stole credentials from the machine, including GitHub tokens, SSH keys and cloud credentials, according to TanStack's advisory.

CrowdSec removed the former employee's account from its GitHub organization on May 25, three days after the copy and months before it learned of the leak.

The former employee's other access had already been removed, which CrowdSec says explains why it saw no suspicious activity in its AWS systems.

CrowdSec says the token left no trace in the GitHub logs it could check and no longer existed when the company learned of the leak.

Mistral AI said a developer device was involved in its case, and OpenAI said two employee devices were affected, with unauthorized access to a limited set of its internal code repositories.

According to CrowdSec, the only usable credential in the leak was for AWS's SNS notification service and could only publish messages to one topic; someone tried to use it on August 17 but got no further.

CrowdSec says other tokens in the code had already been rotated or could not be used from the internet, as far as it knows.

CrowdSec rotated the exposed credentials on September 16 and 17.

CrowdSec did not require endpoint protection software on developers' machines at the time, but it now runs such software on the laptops of staff who work with its code or systems.

Neither CrowdSec's report nor its first statement asks users to take any action.

The 83 exposed user email addresses are about 0.06 percent of CrowdSec's roughly 150,000 users.

CrowdSec says the leak revealed the thresholds the consensus algorithm uses, such as how many detections it requires before adding an IP address to the blocklist, and that these had not been public before.

CrowdSec says that as far as it knows the blocklist still cannot be poisoned, that an attacker would need tens of detections from tens of trusted engines across tens of separate networks at great cost, and that it can change the thresholds, as it often does.

117 days passed between the May 22 copy of the repositories and the code appearing on an online forum on September 16.

CrowdSec says the former employee's laptop was compromised in May's supply chain attack on TanStack, in which malicious versions of TanStack's npm packages stole credentials from developers' machines.

CrowdSec says GitHub support traced the token's history and confirmed its suspicion that TanStack was the source.

CrowdSec did not say which malicious package reached the former employee's laptop or when, and its report does not include GitHub's own findings; it says its developers' machines were checked and came back clean.