CrowdSec source-code leak: how the breach account changed in 24 hours, from 'no personal data' to 83 users

Executive Summary

On September 16, 2026, the French security company CrowdSec learned that roughly 170 of its private GitHub repositories had been copied back in May and had now surfaced on an online forum.¹²³ The root cause traces to the May 2026 supply-chain compromise of TanStack: on May 11, 84 malicious versions of 42 @tanstack/* npm packages were published to the registry (tracked as CVE-2026-45321), and installing one ran code that stole developer credentials — GitHub tokens, SSH keys and cloud credentials.²⁴ A former CrowdSec employee's laptop was among those hit; the company had kept his GitHub access open so he could finish some work, and on May 22 an attacker used a GitHub OAuth token from his account to clone the private repositories.² CrowdSec removed the account from its GitHub organisation on May 25 — three days after the copy, and months before it knew a breach had occurred.²

What makes this incident instructive is less the breach than how CrowdSec's public account of it changed within 24 hours. Its first statement, on September 17, said flatly: "No client data, login/password, name, organization, or anything else was leaked," that the impact was limited to the company, and that the likely vector was a component used inside CrowdSec that "appeared to have been backdoored to steal an API key" able to read the private code.¹ Its more detailed report a day later, on September 18, told a materially different story on both points: none of the malicious TanStack package versions were actually found in CrowdSec's own code, and the leak was instead pinned to the former employee's retained account; and the leaked archive did in fact contain personal data — the email addresses of 83 CrowdSec users and the names, email addresses and investment context of 51 potential investors from a 2020 system that "was never meant to be public."² CrowdSec's CEO, Philippe Humeau, personally apologised to the investors.²

The security-relevant content of the leak is CrowdSec's own crown jewels: the private repositories held its web console, data-science scripts and models, automation scripts, and — most sensitively — the consensus algorithm that decides which IP addresses land on the blocklists CrowdSec distributes to its ~150,000 users, including the previously non-public thresholds that algorithm uses (how many detections it needs before blocklisting an IP).² CrowdSec assesses that, as far as it knows, the blocklist still cannot be poisoned despite the exposed thresholds, arguing an attacker would need tens of detections from tens of trusted engines across tens of separate networks, at great cost, and that it can change the thresholds at will.²

CrowdSec says the token was used only to copy code, that its infrastructure and databases were not accessed, and that no code was modified; the only usable credential found in the leak was an AWS SNS notification token limited to a single topic, which someone tried and failed to use on August 17.² The company rotated exposed credentials on September 16–17 and now requires endpoint-protection software on the laptops of staff who work with its code — a control it did not require at the time of the compromise.² The honest core of this paper is the gap between the September 17 statement and the September 18 report: a security vendor's first public account of its own breach understated both what leaked and how.

Verification of Claims

1. Claim: About 170 CrowdSec private GitHub repositories were copied via the TanStack supply-chain attack. → Verified → Confirmed by CrowdSec's own statement and detailed report; the copy occurred on May 22, 2026 using a GitHub OAuth token from a former employee's TanStack-compromised laptop, and GitHub support traced the token's history to confirm TanStack as the source.¹²

2. Claim (CrowdSec, September 17): No client data, login/password, name, or organisation was leaked. → Superseded → CrowdSec's own September 18 report disclosed that the leaked archive contained 83 CrowdSec users' email addresses and 51 potential investors' names, email addresses and investment context — contradicting the previous day's statement.¹²

3. Claim (CrowdSec, September 17): The likely vector was a backdoored component inside CrowdSec that stole an API key able to read the private code. → Superseded → The September 18 report states that none of the malicious TanStack versions were found in CrowdSec's code and attributes the leak instead to the former employee's retained GitHub account.¹²

4. Claim: The leaked consensus-algorithm thresholds do not let an attacker poison CrowdSec's blocklist. → Assessed (CrowdSec's own assessment) → CrowdSec states this is true "as far as it knows," citing the cost and the tens-of-engines-across-tens-of-networks requirement, and notes it can change the thresholds.² It is a reasoned first-party assessment of its own product, not an independently verified guarantee.

5. Claim: The same TanStack attack hit other companies. → Verified → Mistral AI said a developer device was involved in its case, and OpenAI said two employee devices were affected with unauthorized access to a limited set of internal code repositories.²

Timeline

Attack Anatomy

Supply-chain compromise (upstream)

On May 11, 2026, an actor published 84 malicious versions across 42 @tanstack/* npm packages, authenticated through a legitimate GitHub Actions OIDC trusted-publisher path (CVE-2026-45321). Installing an affected version executed credential-stealing code that harvested GitHub tokens, SSH keys and cloud credentials from the developer's machine (T1195.001).²⁴

Token theft from a developer machine

A former CrowdSec employee's laptop installed an affected package, and the malware stole a GitHub OAuth token tied to his still-active CrowdSec account (T1528).² Because his other access had already been removed when he left, the token was the remaining path in — which CrowdSec says is why it saw no suspicious activity in its AWS systems.²

Repository cloning

Eleven days later, on May 22, the attacker used that OAuth token to clone roughly 170 private repositories (T1550.001, T1213.003).² The token left no trace in the GitHub logs CrowdSec could check and no longer existed by the time the leak was discovered; GitHub support later traced its history and confirmed TanStack as the source.² CrowdSec states the account was used only to copy code — no infrastructure or databases were accessed and no code was modified.²

Exposure

The archive surfaced on a forum on September 16, containing the private source (web console, data-science models, automation, the blocklist consensus algorithm and its thresholds), 83 users' emails, 51 investors' details, and embedded credentials — of which only an AWS SNS token scoped to one topic was usable (T1552.001).²

Threat Actor Profile

• Attacker: Unattributed. Neither the operator of the TanStack npm compromise nor the party that copied CrowdSec's repositories and posted them has been named. The same upstream compromise reached Mistral AI and OpenAI, indicating an opportunistic, credential-harvesting supply-chain operation rather than a CrowdSec-specific campaign.²
• Attribution confidence: Not applicable; no named actor.
• Notable tradecraft: The intrusion required no exploit against CrowdSec directly — only a poisoned dependency on a developer's machine and a valid, over-retained access token. The damage was bounded by what that single token could reach (read access to private repos) and by CrowdSec having already revoked the former employee's other access.²

MITRE ATT&CK techniques (verified on attack.mitre.org):

Technical Indicators

supply_chain_root:
  - "CVE-2026-45321 — 84 malicious versions across 42 @tanstack/* npm packages, published 2026-05-11"
  - "malicious install stole GitHub tokens, SSH keys, cloud credentials"
access_path:
  - "GitHub OAuth token from a former employee's account (access retained post-departure)"
  - "used 2026-05-22 to clone ~170 private repositories"
leaked_contents:
  - "private source: web console, data-science scripts/models, automation, blocklist consensus algorithm + thresholds"
  - "83 CrowdSec user email addresses"
  - "51 potential investors' names, emails, investment context (from a 2020 system)"
  - "AWS SNS token (only usable credential; scoped to one topic; failed use attempt 2026-08-17)"
network_iocs: none defender-actionable disclosed
note: >
  CrowdSec's first statement (17 Sep) and detailed report (18 Sep) differ on
  both the vector and what personal data leaked; the report is the later,
  authoritative account.

Legal and Regulatory Response

CrowdSec says it will report the exposure of the 51 investors' details to the investors and to the authorities, and its CEO personally apologised to them.² It will contact the 83 affected users.² There is no law-enforcement action or regulator finding reported at this stage; the response has been the company's own — credential rotation on September 16–17 and a new requirement for endpoint-protection software on the laptops of staff who work with its code, a control it lacked at the time of the compromise.²

Impact Assessment

• Confirmed: ~170 private CrowdSec repositories copied; source code for its web console, data-science models, automation and blocklist consensus algorithm (including previously non-public thresholds) exposed.²
• Confirmed: 83 CrowdSec users' email addresses and 51 potential investors' names/emails/investment context leaked — contradicting CrowdSec's first-day "no personal data" statement.¹²
• Confirmed: No infrastructure or database access; no code modified; the one usable leaked credential (AWS SNS, single topic) failed on a use attempt.²
• Assessed (CrowdSec): The blocklist cannot be poisoned despite the leaked consensus thresholds; the leaked code is ~4 months old and has since changed significantly.²
• Unknown: Which specific malicious TanStack package reached the former employee's laptop and when; the full contents GitHub's own trace found (not included in CrowdSec's report); and whether the exposed consensus-algorithm knowledge yields any practical evasion of CrowdSec detections over time.²

Lessons and Defensive Recommendations

For engineering and identity teams:

• Offboarding is an attack-surface decision. A departed employee's GitHub access was retained "to finish some work," and that single over-retained OAuth token was the entire breach path. Time-box any post-departure access, prefer short-lived tokens, and treat "temporary" access grants as scheduled to expire by default.
• The compromise entered through a poisoned dependency on a developer laptop and exfiltrated tokens, SSH keys and cloud credentials. Developer endpoints that hold source-control and cloud credentials are production-adjacent; CrowdSec itself concluded it should run endpoint protection on them and did not at the time. Pair that with credential hygiene: scope tokens tightly (the AWS SNS token's single-topic scope is why it was useless to the attacker) and rotate on any dependency-compromise signal.

For supply-chain defenders:

• CVE-2026-45321 abused a legitimate GitHub Actions OIDC trusted-publisher path to push 84 malicious package versions — a reminder that "trusted publisher" automation is itself a target. Pin and verify dependency versions, monitor for anomalous new releases of packages you consume, and assume that a popular package's compromise means credential theft on any machine that installed it during the window.

For disclosure and communications teams (and readers):

• CrowdSec's first statement asserted more certainty than the investigation supported — "no personal data leaked" and a specific backdoored-component theory — and both were revised within a day. An initial breach statement is a snapshot, not a verdict; where scope is still unknown, say so rather than asserting a clean bill. Readers should treat any first-day "nothing sensitive leaked" claim as provisional until a detailed follow-up confirms it.

Sources