CrowdSec links private GitHub repository leak to TanStack npm compromise
CrowdSec says an attacker copied about 170 private GitHub repositories on May 22 after compromising the laptop of an employee who had just left the company in the TanStack npm supply-chain attack. The French security company said the former employee’s GitHub account remained active so he could complete work, and an OAuth token from that account was used to copy the code.
The archive appeared on an online forum on September 16. CrowdSec said it contained private source code, email addresses for 83 users, and names, email addresses and investment context for 51 prospective investors dating from 2020. It said its infrastructure and databases were not accessed and no code was changed.
Token theft linked to malicious TanStack releases
On May 11, attackers published 84 malicious versions of 42 TanStack npm packages. The incident is tracked as CVE-2026-45321. TanStack said installation of an affected version could run credential-stealing code that collected GitHub tokens, SSH keys and cloud credentials from developers’ machines.
CrowdSec said the repository copy occurred 11 days later. It removed the former employee’s account from its GitHub organization on May 25, three days after the copy, while other access had already been removed. The company said this separation helps explain why it found no suspicious activity in its AWS systems.
The token left no trace in GitHub logs available to CrowdSec and no longer existed when the company learned of the leak. GitHub support subsequently traced the token history, CrowdSec said, confirming its suspicion that the TanStack compromise was the origin. The company did not identify the malicious package that reached the laptop or publish GitHub’s own findings.
What the exposed archive contained
The leaked material came from private repositories rather than CrowdSec’s open-source Security Engine. CrowdSec said it included its web console, data-science scripts and models, automation scripts, and the consensus algorithm used to decide which IP addresses are added to shared blocklists.
The company said the archive was almost four months old and that the code has changed substantially since then. It acknowledged that the leak exposed previously non-public consensus thresholds, including the number of detections needed before an IP address is blocklisted. CrowdSec maintained that poisoning the list would still require tens of detections from tens of trusted engines across tens of separate networks, and said it can alter those thresholds.
The incident sits alongside OpenAI’s TanStack-related repository access incident after the same TanStack campaign affected employee devices and enabled unauthorized access to a limited set of internal code repositories. CrowdSec said it checked developer machines and found them clean.
Credentials rotated and controls changed
CrowdSec said the only usable credential in the archive was an AWS SNS credential limited to publishing messages to a single topic. An attempt to use it on August 17 did not progress further, the company said. Other tokens had already been rotated or were not usable from the internet to its knowledge.
The company rotated exposed credentials on September 16 and 17. It also said that, while endpoint protection was not mandatory on developers’ machines at the time of the incident, it now runs endpoint protection on laptops used by staff working with code or systems. CrowdSec plans to contact the 83 affected users and report the investor data exposure to the investors and authorities.
For businesses, the case makes the operational connection clear: offboarding timelines, package supply-chain controls, developer endpoint protection and token lifecycle management must be treated as one access-control process, because a retained account can turn a stolen token into a repository-level exposure.